SUSE CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

UBUNTU-CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689 GitPython before 3.1.62 Path Traversal via gitmodules path

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

EUVD-2026-87662

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-100689

GitPython versions prior to 3.1.62 are vulnerable to a path traversal flaw when updating submodules. The root cause is the lack of validation for the path field read from an untrusted .gitmodules file during the Submodule.update() operation. While other methods like add() and move() utilize a con...

CVE-2026-100689

GitPython before 3.1.62 does not validate the "path" field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the "name" field, and GitPython's own containment guard Submodule.torelativepath is applied...

PT-2026-99360

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.62 Description GitPython fails to validate the path field read from an untrusted .gitmodules file during submodule updates. While constraints exist for the name field and certain operations like add and move, th...

CVE-2026-100689: Improper Limitation of a Pathname to a Restricted Directory

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-63134

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...

CVE-2026-63134 Malcolm's Path Traversal in Archive Extraction Allows Arbitrary Directory Creation

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...

CVE-2026-63134

Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, safe-extract.py protects file extraction with libarchive's secure flags, but creates directory entries with a raw os.makedirsos.path.joindest, entry.pathname that has no traversal protection. An uploaded malicious archive...

CVE-2026-63134

Malcolm (network traffic analysis tool) is affected by a path-traversal vulnerability in the archive extraction code prior to v26.07.0. safe-extract.py uses libarchive secure flags but creates directories with os.makedirs(dest/entry.pathname) without traversal protection, allowing a malicious arc...

Python 3.2.x < 3.2.6, 3.3.x < 3.3.6, 3.4.x < 3.4.1 os.makedirs() not thread-safe (bpo-21082) - Linux

Python is prone to a local security bypass vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...

PSF-2014-5 os.makedirs() not thread-safe

Race condition in the getmaskedmode function in Lib/os.py in Python 3.2 through 3.5, when existok is set to true and multiple threads are used, might allow local users to bypass intended file permissions by leveraging a separate application vulnerability before the umask has been set to the...

Updated python3 packages fix security vulnerability

It was reported that a patch added to Python 3.2 caused a race condition where a file created could be created with world read/write permissions instead of the permissions dictated by the original umask of the process. This could allow a local attacker that could win the race to view and edit fil...