Executive brief
GitPython is a Python library that developers use to interact with Git repositories programmatically. When cloning a repository containing Git submodules, GitPython fails to validate submodule names from .gitmodules configuration files, allowing an attacker to create Git repositories at arbitrary locations on the victim's filesystem outside the intended clone directory. This could enable attackers to write malicious code or data to sensitive system locations if a user clones and initializes submodules from a malicious repository.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in GitPython's submodule handling. The root cause lies in src/GitPython/git/objects/submodule/util.py and src/GitPython/git/objects/submodule/base.py, where the sm_name() function extracts the submodule name from .gitmodules without validation. Unlike the submodule path (which is tree-validated), the name is used directly in Submodule._module_abspath() to construct the on-disk Git directory path via os.path.join(parent_repo.git_dir, "modules", name), which does not normalize path traversal sequences like "../". When submodule initialization is triggered (submodule_update(init=True)), this path is passed to os.makedirs() and git clone --separate-git-dir, creating a fully initialized Git repository at an attacker-controlled location outside the clone directory. The attack requires that a victim clone a malicious repository and run submodule initialization—a routine, often automatic operation in CI/CD pipelines. No authentication is required. The vulnerability is fixed in GitPython 3.1.58; prior versions up to 3.1.57 are affected.
Affected products
- GitPython-developers GitPython <=3.1.57
Timeline
- 2026-08-04: disclosed
- 2026-08-04: patched: Fix released in GitPython 3.1.58