Path Traversal Vulnerability in GitPython by GitPython Developers

CVE-2026-76222

What is CVE-2026-76222?

GitPython versions before 3.1.58 are susceptible to a path traversal vulnerability due to improper validation of submodule names specified in .gitmodules files. This flaw enables attackers to define malicious submodule names that may include traversal sequences, subsequently leading to the creation of Git repositories in arbitrary filesystem locations outside the designated clone directory. Such an exploit allows for potentially severe unauthorized access to the filesystem, as GitPython may process these crafted names during submodule initialization, thereby creating access points for attacker-controlled repositories.

References