{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agitpythongitpython/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gitpython:gitpython:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-114145"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["GitPython (\u003c 3.2.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["GitPython"],"content_html":"\u003cp\u003eGitPython prior to 3.2.1 contains a vulnerability in create_submodule() in git/objects/submodule/base.py. The function accepts an attacker-influenced submodule path (such as .git/hooks) and invokes _clone_repo() before rejecting the destination. In 3.1.x, the call succeeds silently. In 3.2.0 and later affected revisions, a check in git/index/base.py raises a ValueError only after the clone has written to disk and does not remove the planted file. This allows an attacker to place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination that is sufficiently empty. This issue is fixed in version 3.2.1.\u003c/p\u003e\n","date_modified":"2026-10-22T20:00:35Z","date_published":"2026-10-21T21:41:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gitpython-path-traversal/","summary":"GitPython versions prior to 3.2.1 are vulnerable to a path traversal flaw in the create_submodule() function, which allows an attacker-influenced submodule path to lead to the execution of a planted post-checkout hook.","title":"GitPython: Path traversal and arbitrary code execution (CVE-2026-114145)","url":"https://feed.craftedsignal.io/briefs/2026-10-gitpython-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:gitpython:gitpython:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}