GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

🗓️ 07 Aug 2026 15:45:39Reported by GitHub Advisory DatabaseType

GitPython can place a repository outside clone if .gitmodules submodule name is attacker-controlled.

Reporter	Title	Published	Views	Family All 119
AlpineLinux	CVE-2026-76222	19 Aug 202614:02	–	alpinelinux
AstraLinux	Astra Linux – Vulnerability in python-git	15 Oct 202615:53	–	astralinux
BDU FSTEC	GitPython sm_name() Function	24 Aug 202600:00	–	bdu_fstec
Chainguard	CVE-2026-76222 vulnerabilities	9 Sep 202620:54	–	cgr
Circl	CVE-2026-76222	8 Sep 202622:35	–	circl
CVE	CVE-2026-76222	19 Aug 202614:02	–	cve
Cvelist	CVE-2026-76222 GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name	19 Aug 202614:02	–	cvelist
Debian	[SECURITY] [DLA 4872-1] python-git security update	31 Oct 202617:03	–	debian
Debian	[SECURITY] [DSA 6594-1] python-git security update	29 Oct 202618:53	–	debian
Debian CVE	CVE-2026-76222	19 Aug 202614:02	–	debiancve

Vulners

Node

Source	Link
github	www.github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc
github	www.github.com/gitpython-developers/GitPython/pull/2202
github	www.github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c
github	www.github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06
github	www.github.com/gitpython-developers/GitPython/releases/tag/3.1.58
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-76222
github	www.github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3784.yaml
vulncheck	www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name
github	www.github.com/advisories/GHSA-hmq2-w58f-27jc

08 Sep 2026 20:55Current

7.4High risk

Vulners AI Score7.4

CVSS 3.18.2

CVSS 48.4

EPSS0.00422

SSVC