{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/gitpython--3.1.57/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*","cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*","cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*","cpe:2.3:a:git-scm:git:2.17.0:*:*:*:*:*:*:*","cpe:2.3:a:gitforwindows:git:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2018-11235"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitPython","GitPython (\u003c= 3.1.57)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","input-validation","gitpython","python"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eGitPython is vulnerable to a path traversal flaw (CWE-22) when initializing submodules. The library's \u003ccode\u003esm_name()\u003c/code\u003e function, which extracts the name of a submodule from the \u003ccode\u003e.gitmodules\u003c/code\u003e file, performs no validation on the returned string. When \u003ccode\u003esubmodule_update(init=True)\u003c/code\u003e is called, the library constructs an absolute path for the submodule's separate Git directory by joining the target directory with the unvalidated submodule name.\u003c/p\u003e\n\u003cp\u003eAn attacker can craft a malicious Git repository containing a \u003ccode\u003e.gitmodules\u003c/code\u003e file with a submodule name consisting of directory traversal sequences (e.g., \u003ccode\u003e../../../../path/to/target\u003c/code\u003e). When a victim clones this repository and initializes the submodules using GitPython, the library creates a new, fully initialized Git repository at the attacker-specified path. This vulnerability affects GitPython versions up to and including 3.1.57. This vulnerability is significant because it mirrors a class of attacks historically patched in the core Git CLI (CVE-2018-11235), and it poses a high risk to automated systems such as CI/CD pipelines, IDEs, and dependency managers that automatically clone and initialize submodules using GitPython.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker creates a malicious Git repository and modifies the \u003ccode\u003e.gitmodules\u003c/code\u003e file.\u003c/li\u003e\n\u003cli\u003eAttacker sets the \u003ccode\u003e[submodule \u0026quot;...\u0026quot;]\u003c/code\u003e header name to include traversal sequences (e.g., \u003ccode\u003e../../../../tmp/malicious_dir\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker hosts the repository on a platform accessible to the victim.\u003c/li\u003e\n\u003cli\u003eVictim executes a process that uses GitPython to clone the repository (e.g., \u003ccode\u003egit.Repo.clone_from()\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe application calls \u003ccode\u003esm.update(init=True)\u003c/code\u003e or \u003ccode\u003erepo.submodules\u003c/code\u003e on the cloned repository.\u003c/li\u003e\n\u003cli\u003eGitPython parses the malicious \u003ccode\u003e.gitmodules\u003c/code\u003e name field without validation.\u003c/li\u003e\n\u003cli\u003eGitPython joins the unsafe name to the base directory path using \u003ccode\u003eos.path.join\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eGitPython executes a command or file operation to create a new Git repository at the traversal-escaped path.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the creation of arbitrary directories and Git repositories on the victim's filesystem, limited only by the privileges of the process running GitPython. This can lead to arbitrary file writes, potential overwriting of critical configuration files if the path is carefully chosen, and the introduction of malicious Git hooks or configurations at locations controlled by the attacker. Automated build environments are particularly susceptible due to the high volume of automated submodule initialization.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate GitPython to a version where submodule name validation is implemented to prevent directory traversal.\u003c/li\u003e\n\u003cli\u003eRestrict the privileges of service accounts executing GitPython clones, ensuring they operate with minimal filesystem permissions.\u003c/li\u003e\n\u003cli\u003eImplement pre-processing logic to validate submodule names in \u003ccode\u003e.gitmodules\u003c/code\u003e files before passing them to GitPython, ensuring they do not contain path traversal characters.\u003c/li\u003e\n\u003cli\u003eAudit CI/CD configurations to determine if GitPython is used for recursive submodule initialization and move to hardened environments where possible.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-07T21:31:48Z","date_published":"2026-08-07T21:31:39Z","id":"https://feed.craftedsignal.io/briefs/2026-08-gitpython-traversal/","summary":"GitPython fails to validate submodule names defined in .gitmodules files, allowing attackers to perform path traversal and create arbitrary Git repositories outside the intended working tree during submodule initialization.","title":"Path Traversal in GitPython via Malicious Submodule Names","url":"https://feed.craftedsignal.io/briefs/2026-08-gitpython-traversal/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitPython (\u003c= 3.1.57)"],"_cs_severities":["high"],"_cs_tags":["execution","library-vulnerability","command-injection","remote-code-execution","injection","gitpython","supply-chain"],"_cs_type":"advisory","_cs_vendors":["GitPython"],"content_html":"\u003cp\u003eGitPython versions up to and including 3.1.57 contain a command injection vulnerability stemming from an incomplete fix for a previous guard bypass (GHSA-r9mr-m37c-5fr3). The library provides an \u003ccode\u003eunsafe_git_clone_options\u003c/code\u003e guard to prevent the passage of dangerous flags (e.g., \u003ccode\u003e--upload-pack\u003c/code\u003e) to the underlying git binary. An attacker who can control keyword arguments passed to GitPython methods (like \u003ccode\u003eclone_from\u003c/code\u003e, \u003ccode\u003efetch\u003c/code\u003e, or \u003ccode\u003epush\u003c/code\u003e) can bypass this guard by setting \u003ccode\u003esplit_single_char_options=False\u003c/code\u003e and providing a single-character key with a value containing a malicious command.\u003c/p\u003e\n\u003cp\u003eThe guard's candidate inspection logic fails to generate candidates for the joined tokens created when \u003ccode\u003esplit_single_char_options\u003c/code\u003e is disabled. Consequently, the guard inspects the single-character key (e.g., '-n'), finds it safe, and passes. The subsequent \u003ccode\u003etransform_kwarg\u003c/code\u003e logic then assembles a joined token (e.g., \u003ccode\u003e-nutouch \u0026lt;cmd\u0026gt;;git-upload-pack\u003c/code\u003e) which the git binary parses as the \u003ccode\u003e--upload-pack\u003c/code\u003e flag. This results in the execution of the injected command with the privileges of the host process.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an application endpoint that forwards user-controlled dictionaries as keyword arguments to a GitPython method (e.g., \u003ccode\u003eRepo.clone_from(url, path, **kwargs)\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAttacker provides a payload dict: \u003ccode\u003e{'split_single_char_options': False, 'n': 'utouch /tmp/ACE;git-upload-pack'}\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eGitPython internal \u003ccode\u003e_option_candidates\u003c/code\u003e function processes the kwargs and identifies only \u003ccode\u003e['-n']\u003c/code\u003e as a candidate.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003echeck_unsafe_options\u003c/code\u003e compares \u003ccode\u003e['-n']\u003c/code\u003e against the safety denylist.\u003c/li\u003e\n\u003cli\u003eThe denylist check passes because \u003ccode\u003e['-n']\u003c/code\u003e is not considered an unsafe option, failing to see the smuggled command within the value.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003etransform_kwarg\u003c/code\u003e function merges the key and value into a single CLI token: \u003ccode\u003e-nutouch /tmp/ACE;git-upload-pack\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe final argument list is passed to the underlying \u003ccode\u003egit\u003c/code\u003e subprocess.\u003c/li\u003e\n\u003cli\u003eGit parses the joined flag as \u003ccode\u003e--upload-pack=utouch /tmp/ACE;git-upload-pack\u003c/code\u003e, leading to arbitrary command execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary OS command execution as the user running the GitPython process. This vulnerability affects any application utilizing GitPython's guarded methods while exposing kwargs to user input. The impact is significant as it facilitates unauthorized code execution and potential lateral movement or system compromise within environments hosting Git-integrated automation or CI/CD pipelines.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize upgrading GitPython to a version where \u003ccode\u003e_option_candidates\u003c/code\u003e includes value-derived candidates regardless of \u003ccode\u003esplit_single_char_options\u003c/code\u003e. If an immediate patch is unavailable, audit all code paths that forward user-supplied dictionaries as \u003ccode\u003e**kwargs\u003c/code\u003e to GitPython methods. Implement strict allowlisting for all keyword arguments instead of relying on the library's default guards.\u003c/p\u003e\n","date_modified":"2026-08-07T21:31:55Z","date_published":"2026-08-07T21:31:23Z","id":"https://feed.craftedsignal.io/briefs/2026-08-gitpython-bypass/","summary":"A bypass of the GitPython safety guard allows arbitrary OS command execution via token smuggling when using single-character keyword arguments with split_single_char_options=False.","title":"GitPython Command Injection via Unsafe Git Option Guard Bypass","url":"https://feed.craftedsignal.io/briefs/2026-08-gitpython-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - GitPython (\u003c= 3.1.57)","version":"https://jsonfeed.org/version/1.1"}