Vulnerability Description
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitpython Project | Gitpython | < 3.1.58 |
Related Weaknesses (CWE)
References
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-ExploitVendor Advisory
- https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmoduThird Party Advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-ExploitVendor Advisory
FAQ
What is CVE-2026-76222?
CVE-2026-76222 is a vulnerability with a CVSS score of 8.2 (HIGH). GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Atta...
How severe is CVE-2026-76222?
CVE-2026-76222 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-76222?
Check the references section above for vendor advisories and patch information. Affected products include: Gitpython Project Gitpython.