https://feed.craftedsignal.io/products/gitpython--3.2.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 21:41:42 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-gitpython-path-traversal/Wed, 21 Oct 2026 21:41:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-gitpython-path-traversal/GitPython versions prior to 3.2.1 are vulnerable to a path traversal flaw in the create_submodule() function, which allows an attacker-influenced submodule path to lead to the execution of a planted post-checkout hook.<p>GitPython prior to 3.2.1 contains a vulnerability in create_submodule() in git/objects/submodule/base.py. The function accepts an attacker-influenced submodule path (such as .git/hooks) and invokes _clone_repo() before rejecting the destination. In 3.1.x, the call succeeds silently. In 3.2.0 and later affected revisions, a check in git/index/base.py raises a ValueError only after the clone has written to disk and does not remove the planted file. This allows an attacker to place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination that is sufficiently empty. This issue is fixed in version 3.2.1.</p> highadvisory