Executive brief
GitPython is a Python library used by developers and automation tools to interact with Git repositories. When a cloned repository contains a malicious .gitmodules file, GitPython fails to properly restrict include directives, allowing attackers to read the first line of any file on the system accessible to the user running the code. This disclosure occurs when applications perform routine operations like listing submodules, potentially exposing sensitive data such as API keys, credentials, or system information.
Technical details
The vulnerability exists in SubmoduleConfigParser (git/objects/submodule/base.py), which inherits the default merge_includes=True from GitConfigParser.__init__ when parsing the attacker-controlled .gitmodules file. GitConfigParser.read() performs no repository-boundary containment on include paths—absolute paths bypass checks entirely, and relative paths use simple path join operations without validation. When a non-INI file is included (e.g., /etc/passwd), GitConfigParser._read() raises configparser.MissingSectionHeaderError, which embeds the file's first line verbatim in the exception message. The exception propagates unhandled to the caller, disclosing content to any error-logging or monitoring system. Exploitation requires only that a victim clone or open a malicious repository and access repo.submodules—a routine read-only operation requiring no authentication or submodule updates. GitPython 3.1.59 and later patch this by passing merge_includes=False to SubmoduleConfigParser.
Affected products
- GitPython GitPython <= 3.1.58
Timeline
- 2026-08-10: disclosed
- 2026-08-25: advisory
- 2026-08-25: patched: GitPython 3.1.59 released with fix