GitPython: Path traversal and arbitrary code execution (CVE-2026-114145)
GitPython versions prior to 3.2.1 are vulnerable to a path traversal flaw in the create_submodule() function, which allows an attacker-influenced submodule path to lead to the execution of a planted post-checkout hook.
CVE search metadata
CVE search record: CVE-2026-114145. Severity: high. CVSS: 7.5. KEV: no. Product: GitPython (< 3.2.1). Brief: GitPython: Path traversal and arbitrary code execution (CVE-2026-114145). Brief link: https://feed.craftedsignal.io/briefs/2026-10-gitpython-path-traversal/
Triage facts
Revision 1- Applicability
- GitPython (< 3.2.1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 21, 21:41 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
GitPython prior to 3.2.1 contains a vulnerability in create_submodule() in git/objects/submodule/base.py. The function accepts an attacker-influenced submodule path (such as .git/hooks) and invokes _clone_repo() before rejecting the destination. In 3.1.x, the call succeeds silently. In 3.2.0 and later affected revisions, a check in git/index/base.py raises a ValueError only after the clone has written to disk and does not remove the planted file. This allows an attacker to place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination that is sufficiently empty. This issue is fixed in version 3.2.1.