{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3oredhatenterprise_linux_server7.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*","cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","cpe:2.3:a:git-scm:git:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:gitforwindows:git:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2018-11235"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitPython","GitPython (\u003c= 3.1.57)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","input-validation","gitpython","python"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eGitPython is vulnerable to a path traversal flaw (CWE-22) when initializing submodules. The library's \u003ccode\u003esm_name()\u003c/code\u003e function, which extracts the name of a submodule from the \u003ccode\u003e.gitmodules\u003c/code\u003e file, performs no validation on the returned string. When \u003ccode\u003esubmodule_update(init=True)\u003c/code\u003e is called, the library constructs an absolute path for the submodule's separate Git directory by joining the target directory with the unvalidated submodule name.\u003c/p\u003e\n\u003cp\u003eAn attacker can craft a malicious Git repository containing a \u003ccode\u003e.gitmodules\u003c/code\u003e file with a submodule name consisting of directory traversal sequences (e.g., \u003ccode\u003e../../../../path/to/target\u003c/code\u003e). When a victim clones this repository and initializes the submodules using GitPython, the library creates a new, fully initialized Git repository at the attacker-specified path. This vulnerability affects GitPython versions up to and including 3.1.57. This vulnerability is significant because it mirrors a class of attacks historically patched in the core Git CLI (CVE-2018-11235), and it poses a high risk to automated systems such as CI/CD pipelines, IDEs, and dependency managers that automatically clone and initialize submodules using GitPython.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates a malicious Git repository and modifies the \u003ccode\u003e.gitmodules\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eAttacker sets the \u003ccode\u003e[submodule \u0026quot;...\u0026quot;]\u003c/code\u003e header name to include traversal sequences (e.g., \u003ccode\u003e../../../../tmp/malicious_dir\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker hosts the repository on a platform accessible to the victim.\u003c/li\u003e\n\u003cli\u003eVictim executes a process that uses GitPython to clone the repository (e.g., \u003ccode\u003egit.Repo.clone_from()\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application calls \u003ccode\u003esm.update(init=True)\u003c/code\u003e or \u003ccode\u003erepo.submodules\u003c/code\u003e on the cloned repository.\u003c/li\u003e\n\u003cli\u003eGitPython parses the malicious \u003ccode\u003e.gitmodules\u003c/code\u003e name field without validation.\u003c/li\u003e\n\u003cli\u003eGitPython joins the unsafe name to the base directory path using \u003ccode\u003eos.path.join\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eGitPython executes a command or file operation to create a new Git repository at the traversal-escaped path.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the creation of arbitrary directories and Git repositories on the victim's filesystem, limited only by the privileges of the process running GitPython. This can lead to arbitrary file writes, potential overwriting of critical configuration files if the path is carefully chosen, and the introduction of malicious Git hooks or configurations at locations controlled by the attacker. Automated build environments are particularly susceptible due to the high volume of automated submodule initialization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate GitPython to a version where submodule name validation is implemented to prevent directory traversal.\u003c/li\u003e\n\u003cli\u003eRestrict the privileges of service accounts executing GitPython clones, ensuring they operate with minimal filesystem permissions.\u003c/li\u003e\n\u003cli\u003eImplement pre-processing logic to validate submodule names in \u003ccode\u003e.gitmodules\u003c/code\u003e files before passing them to GitPython, ensuring they do not contain path traversal characters.\u003c/li\u003e\n\u003cli\u003eAudit CI/CD configurations to determine if GitPython is used for recursive submodule initialization and move to hardened environments where possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-07T21:31:48Z","date_published":"2026-08-07T21:31:39Z","id":"https://feed.craftedsignal.io/briefs/2026-08-gitpython-traversal/","summary":"GitPython fails to validate submodule names defined in .gitmodules files, allowing attackers to perform path traversal and create arbitrary Git repositories outside the intended working tree during submodule initialization.","title":"Path Traversal in GitPython via Malicious Submodule Names","url":"https://feed.craftedsignal.io/briefs/2026-08-gitpython-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}