Submodule Path Vulnerability in GitPython Library

CVE-2026-114145

What is CVE-2026-114145?

The GitPython library, used for interacting with Git repositories, contains a vulnerability in its create_submodule() function that allows the acceptance of attacker-controlled submodule paths, including sensitive locations such as .git/hooks. This can lead to an executable being placed in a location that executes during later Git operations, post-checkout. The vulnerability exists in versions prior to 3.2.1, with the potential for exploitation heightened if the target repository's hooks directory is empty. Users are encouraged to update to version 3.2.1 or later to mitigate this risk.

References