CVE-2026-100689 gitpython-developers CVE debrief

Who should care

Developers and administrators using GitPython, especially those who update submodules at non-HEAD commits, should assess exposure and verify if their versions are affected. This includes reviewing application flows for submodule updates and prioritizing remediation if necessary. Security teams should monitor for suspicious activity and review compensating controls for exposed systems.

Why it matters

GitPython before 3.1.62 is vulnerable to a path traversal attack, allowing an attacker to create directories outside the repository working tree. Developers and administrators should assess exposure, verify affected versions, and prioritize remediation.

• Path traversal can lead to directory creation outside the repository working tree
• Potential for data tampering or unauthorized access
• Requires verification of affected versions and remediation priority
• Exposure is limited to specific application flows that update submodules at non-HEAD commits

Technical summary

GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. This allows an attacker to create directories outside the repository working tree by manipulating the `path` field. The issue is fixed in GitPython 3.1.62. Exploitation requires an application flow that updates submodules at a non-HEAD commit. The common clone-then-update flow is not affected as it re-derives the path from a canonical tree lookup. Developers and administrators should assess exposure and verify if their versions are affected.

Defensive priority

High

Recommended defensive actions

• Update GitPython to version 3.1.62 or later
• Review and restrict access to .gitmodules files
• Monitor for suspicious activity in GitPython repositories
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. Evidence is limited to public CVE details and vendor advisories. Defenders should verify affected versions, review application flows for submodule updates, and assess exposure in their environments. The CVE Program and NVD provide official records and assessments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.