# CVE-2026-114145: GitPython submodule path traversal to arbitrary hook execution

Source: https://junglewise.ai/threats/cve-2026-114145-gitpython-is-a-python-library-used-to-interact-with-git  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114145 · Severity: high · CVSS 7.5 · Published 2026-10-21

GitPython is a Python library that allows applications to interact with Git repositories. A vulnerability in the create_submodule() function allows an attacker to place an executable Git hook (such as a post-checkout hook) in the .git/hooks directory by supplying a malicious submodule path. When a later Git operation is performed, this planted hook executes with the privileges of the user running the Git operation, potentially enabling code execution on the system.

Technologies: [gitpython (PyPI)](https://junglewise.ai/threats/technologies/pypi-gitpython). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-114145 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114145 being exploited in the wild.

**How severe is CVE-2026-114145?** High severity, with a CVSS score of 7.5, published 21 October 2026.

**Which products and versions are affected?** GitPython contributors GitPython prior to 3.2.1; gitpython (PyPI) <= 3.2.0, ECOSYSTEM:introduced=0,fixed=3.2.1.

**Is there a fix for CVE-2026-114145?** Yes. gitpython (PyPI): upgrade to 3.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114145 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-114145?** Check whether you run GitPython contributors GitPython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- gitpython (PyPI): upgrade to 3.2.1 or later

  ```sh
  pip install "gitpython>=3.2.1"
  ```


## Technical details

The create_submodule() function in git/objects/submodule/base.py accepts attacker-controlled submodule paths and invokes _clone_repo() before safely validating the destination. In GitPython 3.1.x and affected 3.2.0+ revisions, an attacker can supply a path like .git/hooks as the destination, bypassing containment checks and writing to Git metadata directories. The vulnerability requires an application to accept untrusted submodule paths and a clone destination empty enough for Git to populate, typically when default sample hooks are absent. The fix validates destinations before mutation using portable path validation that prevents NTFS/HFS metadata aliases and invalid paths.

## Affected products

- GitPython contributors GitPython prior to 3.2.1

## Identifiers

- CVE-2026-114145
- GHSA-83vg-56qc-22m7

## Timeline

- 2026-10-21: disclosed
- 2026-10-02: patched

## References

- [https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697](https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697)
- [https://github.com/gitpython-developers/GitPython/pull/2264](https://github.com/gitpython-developers/GitPython/pull/2264)

## Related threats

- [GitPython command wrappers omit unsafe protocol and option checks](https://junglewise.ai/threats/cve-2026-110857-gitpython-command-wrappers-omit-unsafe-protocol-and-option)
- [GitPython symlink following in Submodule.move()](https://junglewise.ai/threats/cve-2026-110860-gitpython-from-3-1-62-before-3-2-0-contains-a-symlink-following)
- [GitPython argument injection in Head.checkout()](https://junglewise.ai/threats/cve-2026-110859-gitpython-before-3-2-0-contains-an-argument-injection)
- [GitPython remote code execution in Remote.pull() refspec argument](https://junglewise.ai/threats/cve-2026-110858-gitpython-from-3-1-30-before-3-2-0-contains-a-remote-code)
- [GitPython regular expression denial of service in parse_actor_and_date](https://junglewise.ai/threats/cve-2026-110856-gitpython-before-3-2-0-contains-a-regular-expression-denial-of)