Is CVE-2026-100689 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100689 being exploited in the wild.

How severe is CVE-2026-100689?

Medium severity, with a CVSS score of 5.9, published 26 September 2026.

Which products and versions are affected?

GitPython before 3.1.62; gitpython (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.62.

Is there a fix for CVE-2026-100689?

Yes. gitpython (PyPI): upgrade to 3.1.62 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100689 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-100689?

Check whether you run GitPython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100689: GitPython path traversal in .gitmodules submodule update

CVE-2026-100689 · Severity: medium · CVSS 5.9 · Published 2026-09-26

GitPython is a library that manages Git repositories programmatically. When updating Git submodules from an untrusted .gitmodules file, the library fails to validate the path field, allowing attackers to create directories outside the repository and populate them with submodule content. This attack requires a specific application pattern where submodules are updated at historical commits rather than the latest version.

Technologies: GitPython, gitpython (PyPI). Vendors: GitPython, PyPI.

Quick answers

Is CVE-2026-100689 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100689 being exploited in the wild.
How severe is CVE-2026-100689?: Medium severity, with a CVSS score of 5.9, published 26 September 2026.
Which products and versions are affected?: GitPython before 3.1.62; gitpython (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.62.
Is there a fix for CVE-2026-100689?: Yes. gitpython (PyPI): upgrade to 3.1.62 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100689 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-100689?: Check whether you run GitPython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gitpython (PyPI): upgrade to 3.1.62 or later
```
pip install "gitpython>=3.1.62"
```

Technical details

The vulnerability is a path traversal in the Submodule.update() method (CWE-22). While GitPython's _to_relative_path() containment guard is correctly applied in add() and move(), the update() method reads the path field directly from .gitmodules without validation, passing it unguarded to os.makedirs() at the absolute checkout location. Exploitation requires application code that explicitly updates submodules at non-HEAD commits; the standard clone-then-update flow is unaffected because it re-derives the path from canonical tree data rather than the untrusted .gitmodules file.

Affected products

GitPython GitPython before 3.1.62

Identifiers

CVE-2026-100689
GHSA-59cr-6r3x-644w

Timeline

2026-09-26: disclosed
2026-09-26: patched: Fixed in GitPython 3.1.62

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.