{"schema":"threatline.record/2","record":{"id":"CVE-2026-100689","aliases":["GHSA-59cr-6r3x-644w"],"summary":"GitPython before 3.1.62 Path Traversal via gitmodules path","details":"GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the `name` field, and GitPython's own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw `path` value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62.","categories":["Libraries & packages"],"product":"GitPython","vendor":"gitpython-developers","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100689","source_modified_at":"2026-10-08T15:21:59.548Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"GitPython","vendor":"gitpython-developers","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"3.1.62"},{"version":"3.1.62","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-59cr-6r3x-644w","source_modified_at":"2026-10-01T00:00:05.754996881Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"gitpython","purl":"pkg:pypi/gitpython"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"3.1.62"}],"type":"ECOSYSTEM"}],"versions":["0.1.7","0.2.0-beta1","0.3.0-beta1","0.3.0-beta2","0.3.1-beta2","0.3.2","0.3.2.1","0.3.2.RC1","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","1.0.0","1.0.1","1.0.2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.0.9.dev0","2.0.9.dev1","2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5"]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-100689","source_modified_at":"2026-10-08T15:21:59.548Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"GitPython","ecosystem":null},"version":"3.1.62","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-59cr-6r3x-644w","source_modified_at":"2026-10-01T00:00:05.754996881Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"PyPI","name":"gitpython","purl":"pkg:pypi/gitpython"},"version":"3.1.62"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00401,"percentile":0.33254,"score_date":"2026-10-23"},"published_at":"2026-09-26T13:23:48.759Z","modified_at":"2026-10-08T15:21:59.548Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-100689","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-08T15:21:59.548Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-59cr-6r3x-644w","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-01T00:00:05.754996881Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100689","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.62-path-traversal-via-gitmodules-path","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-30T17:41:00.466396Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-08T15:21:59.548Z","content_hash":"6d2f2cdc610666d06c365014988fabd4b0dcc88ace47c569efc1d7940bec4890"}}