cve-2024-32002-poc-rce

CVE-2024-32002 RCE POC A POC for CVE-2024-32002 demonstrating Remote Code Execution RCE. See cve-2024-32002-poc-rce for the related submodule repository. What this repo contains A symlink with an arbitraty name that links to the .git directory. A .gitmodules file that defines the malicious...

CVE-2025-48384-test

Reproduce Command Line git clone --recursive https://github.com/beishanxueyuan/CVE-2025-48384-test.git 修改指向的GitHub仓库 git init repo git -C repo -c protocol.file.allow=always submodule add https://github.com/beishanxueyuan/CVE-2025-48384.git sub git -C repo mv sub $printf "sub\r" git config unset -...

CVE-2017-1000117

CVE-2017-1000117 How it works? $ git clone --recursive [email protected]:ikmski/CVE-2017-1000117.git How to create this repository $ cat message.txt | gzip | base64 command $ git submodule add [email protected]:ikmski/Hello-World.git subs/CVE-2017-1000117 $ cat .gitmodules submodule...

CVE-2023-51385_test

Verify CVE-2023-51385 First, add the following content to /.ssh/config host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Command injection exists in the .gitmodules file statement url = ssh://echo helloworld cve.txtfoo.example.com/bar After configuration, execute the...

CVE-2023-51385_test

Verify CVE-2023-51385 First, add the following to /.ssh/config 主机 .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p Command injection exists in the .gitmodules file statement url = ssh://echo helloworld cve.txtfoo.example.com/bar After configuration is complete, execute the...

cve-2024-32002-poc

💥 CVE-2024-32002 – Git Submodule Path Injection PoC Motivation While solving the Compiled machine on the Hack The Box platform, I came across a curious behavior involving Git and submodules. Upon investigating further, I found this excellent post by researcher Amal Murali, which details a path...

cve-2023-51385

Verify CVE-2023-51385 First, add the following content to /.ssh/config host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p There is a command injection in the .gitmodules file statement url = ssh://echo helloworld cve.txtfoo.example.com/bar After configuration, execute t...

CVE-2017-1000117

CVE-2017-1000117 Malicious actors can craft "ssh://…" links to trick victims into accessing the malicious link when executing programs, thereby achieving command execution. This link can be placed in the .gitmodules file of a git project, so that when a victim performs git clone...

CVE-2018-11235

CVE-2018-11235 Vulnerability Overview Vulnerability Name: Git Security Vulnerability CNNVD ID: CNNVD-201805-1020 Severity Level: High CVE ID: CVE-2018-11235 Vulnerability Type: Security Feature Issue Published Date: 2018-05-31 Threat Type: Remote Updated Date: 2019-04-01 Vendor: git-scm...

CVE-2023-51385_test

Verifying CVE-2023-51385 First, add the following content to /.ssh/config host .example.com ProxyCommand /usr/bin/nc -X connect -x 192.0.2.0:8080 %h %p There is a command injection in the .gitmodules file statement url = ssh://echo helloworld cve.txtfoo.example.com/bar After configuration is...

EUVD-2026-101743

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

UBUNTU-CVE-2026-110860

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

CVE-2026-110860

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

DEBIAN-CVE-2026-110860

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

CVE-2026-110860

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

CVE-2026-110860

The GitPython library (versions 3.1.62 before 3.2.0 ) is vulnerable to a symlink path traversal flaw within the Submodule.move() function. The root cause is that the function performs only lexical destination checks and fails to reject symbolic links in intermediate path components. An attacker p...

CVE-2026-110860 GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

CVE-2026-110860 GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

CVE-2026-110855 GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name

GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separategitdir in Repo.clone, which omits expandvars=False when calling Git.polishurl. Attackers can craft a .gitmodules submodule name containing variabl...

CVE-2026-110860: Improper Link Resolution Before File Access

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...