{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gitpython--3.2.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-114145"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GitPython (\u003c 3.2.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eGitPython prior to 3.2.1 contains a vulnerability in create_submodule() in git/objects/submodule/base.py. The function accepts an attacker-influenced submodule path (such as .git/hooks) and invokes _clone_repo() before rejecting the destination. In 3.1.x, the call succeeds silently. In 3.2.0 and later affected revisions, a check in git/index/base.py raises a ValueError only after the clone has written to disk and does not remove the planted file. This allows an attacker to place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination that is sufficiently empty. This issue is fixed in version 3.2.1.\u003c/p\u003e\n","date_modified":"2026-10-21T21:41:42Z","date_published":"2026-10-21T21:41:42Z","id":"https://feed.craftedsignal.io/briefs/2026-10-gitpython-path-traversal/","summary":"GitPython versions prior to 3.2.1 are vulnerable to a path traversal flaw in the create_submodule() function, which allows an attacker-influenced submodule path to lead to the execution of a planted post-checkout hook.","title":"GitPython: Path traversal and arbitrary code execution (CVE-2026-114145)","url":"https://feed.craftedsignal.io/briefs/2026-10-gitpython-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - GitPython (\u003c 3.2.1)","version":"https://jsonfeed.org/version/1.1"}