EUVD-2026-65221
GHSA-crmc-f4m7-33fj
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local write access required to introduce malicious .gitmodules; user interaction needed to trigger submodules access; high confidentiality impact but no integrity impact and only limited availability disruption from propagating exceptions.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.
AnalysisAI
GitPython before 3.1.59 discloses local file content through exception messages when parsing .gitmodules files that contain [include] directives, because the library fails to disable the merge_includes feature in GitConfigParser. An attacker who can introduce a malicious .gitmodules into a repository processed by a vulnerable GitPython instance can cause the first line of any locally readable file to appear verbatim in a MissingSectionHeaderError exception when repo.submodules is accessed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must be simultaneously satisfied: (1) the attacker must be able to introduce a .gitmodules file containing a malicious [include] directive into a repository that is subsequently processed by the vulnerable GitPython instance - achievable by hosting an attacker-controlled repository for cloning, by contributing a malicious commit to a shared repository, or by having local write access to a repository on the target filesystem; and (2) the application must execute a code path that calls repo.submodules on the affected repository. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.6 with AV:L/AC:L/AT:N/PR:N reflects that exploitation is locally scoped but requires no elevated privileges or special attack prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a malicious git repository whose .gitmodules contains an [include] directive pointing to /proc/self/environ or a known credential file path on Linux targets. A CI/CD pipeline using GitPython clones this repository and iterates repo.submodules to detect submodule changes. … |
| Remediation | Upgrade GitPython to version 3.1.59 or later, which disables merge_includes during .gitmodules parsing; the vendor advisory is at https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and systems running GitPython versions before 3.1.59, prioritizing production systems and CI/CD pipelines that process external repositories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using
Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution vi
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today