Skip to main content

GitPython EUVDEUVD-2026-62463

| CVE-2026-76222 HIGH
Path Traversal (CWE-22)
2026-08-19 VulnCheck GHSA-3vrx-526r-64rm
Path Traversal Gitpython
8.4
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.4 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.2 HIGH

Attacker-controlled repository delivered over network (AV:N/AC:L/PR:N), victim must trigger submodule init (UI:R), writes escape the clone directory into the broader filesystem (S:C), no confidentiality loss but high integrity and low availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
SUSE
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

4
Patch available
Aug 19, 2026 - 15:17 EUVD
Source Code Evidence Fetched
Aug 19, 2026 - 14:49 vuln.today
Analysis Generated
Aug 19, 2026 - 14:49 vuln.today
CVE Published
Aug 19, 2026 - 14:02 cve.org
HIGH 8.4

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 20 pypi packages depend on gitpython (13 direct, 7 indirect)

Ecosystem-wide dependent count for version 3.1.58.

DescriptionCVE.org

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.

AnalysisAI

Path traversal in GitPython before 3.1.58 allows remote attackers who control a Git repository to create fully initialized, attacker-controlled Git repositories at arbitrary filesystem paths outside the intended clone directory. GitPython's independent submodule implementation reads submodule names from .gitmodules without any validation - a check that core Git added years ago in response to CVE-2018-11235 - and passes the raw, traversal-containing name directly to os.makedirs() and git clone. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Craft malicious .gitmodules with traversal submodule name
Delivery
Host repository on accessible platform
Exploit
Victim clones repository via GitPython
Install
Victim or CI pipeline calls submodule_update(init=True)
C2
GitPython builds unvalidated os.path.join path
Execute
os.makedirs and git clone create repo at escaped filesystem path
Impact
Attacker-controlled hooks and config materialized outside clone directory
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two conditions to be met sequentially: first, the victim must clone an attacker-controlled Git repository using GitPython (versions <= 3.1.57); second, the victim or an automated process must call `submodule_update(init=True)` or `sm.update(init=True)` on that repository, which is the specific API invocation that triggers the unvalidated path construction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.4 reflects high real-world concern: network-reachable delivery (AV:N), low attack complexity (AC:L), no required privileges (PR:N), and passive user interaction (UI:P), with high integrity impact on both the vulnerable system (VI:H) and subsequent filesystem locations (SI:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker publishes a Git repository containing a .gitmodules file with a submodule name set to a traversal string such as `../../../../home/victim/.ssh`, then induces a victim to clone it using GitPython - for example, by submitting a pull request to a project whose CI pipeline clones and initializes submodules from contributor forks. When the pipeline calls `submodule_update(init=True)`, GitPython creates a full Git repository at `/home/victim/.ssh`, populating it with a hooks directory and config file that overwrite or corrupt the SSH authorized_keys directory. …
Remediation Upgrade GitPython to version 3.1.58 or later using `pip install --upgrade 'GitPython>=3.1.58'`; this is the vendor-confirmed fix delivered via GitHub PR #2202 (https://github.com/gitpython-developers/GitPython/pull/2202) and commit 4299c990e1ca21896f9485277caf7bb0ae5b404c. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems and applications using GitPython and assess which clone repositories from untrusted or external sources. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-78676 CRITICAL
9.3 Aug 25

Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67325 HIGH
8.7 Aug 01

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
CVE-2026-67323 HIGH
8.6 Aug 01

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
CVE-2026-73625 HIGH
8.7 Aug 13

Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
CVE-2026-76220 HIGH
8.7 Aug 19

Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using

CVE-2026-78677 HIGH
8.7 Aug 25

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
CVE-2026-76221 HIGH
8.7 Aug 19

Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution vi

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-62463 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy