EUVD-2026-101743

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

CVE-2026-110860

GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move, which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an...

CVE-2026-110860

The GitPython library (versions 3.1.62 before 3.2.0 ) is vulnerable to a symlink path traversal flaw within the Submodule.move() function. The root cause is that the function performs only lexical destination checks and fails to reject symbolic links in intermediate path components. An attacker p...