GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name
Priority HIGH 70CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · Low
- Fix status
- Partial Red Hat: 9 fixed, 7 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00422 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial GitPython (gitpython-developers): 3.1.58GitPython (PyPI): 3.1.58Red Hat: 13 advisoriesRed Hat: 9 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gitpython-developers | GitPython | before 3.1.58 | 3.1.58 | Patch available | CNA |
| — | GitPython (PyPI) | before 3.1.58 | 3.1.58 | Patch available | GHSA-hmq2-w58f-27jc |
- GitPython Vendorgitpython-developers Affected before 3.1.58 Fixed in 3.1.58 Patch available CNA
- GitPython (PyPI) Vendor— Affected before 3.1.58 Fixed in 3.1.58 Patch available GHSA-hmq2-w58f-27jc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* | before 3.1.58 | Vulnerable | gitpython-developers |
- cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* Versions before 3.1.58 Vulnerable ·gitpython-developers
Remediation
- Fix · CNA GitPython (gitpython-developers) Fixed in 3.1.58
- Fix · GHSA-hmq2-w58f-27jc GitPython (PyPI) Fixed in 3.1.58 Advisory →
Red Hat 13 advisories
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:86891 Released 2026-10-21 · Red Hat rating CriticalRHOAI 3.5.2 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Show 10 more Red Hat advisories
- RHSA-2026:79378 Released 2026-10-08 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/gateway-rhel9 +4
- RHSA-2026:71210 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8 +4
- RHSA-2026:71179 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
- RHSA-2026:71177 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9 +4
- RHSA-2026:69539 Released 2026-09-21 · Red Hat rating ImportantRHOAI 3.5.1 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-mlserver-cuda-rhel9, registry.redhat.io/rhoai/odh-mlserver-rhel9 +28
- RHSA-2026:68780 Released 2026-09-17 · Red Hat rating CriticalTechnical preview of the satellite/iop-vmaas-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
- RHSA-2026:68776 Released 2026-09-17 · Red Hat rating Criticalsatellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
- RHSA-2026:68771 Released 2026-09-17 · Red Hat rating Criticalsatellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
- RHSA-2026:68764 Released 2026-09-17 · Red Hat rating CriticalTechnical preview of the satellite/iop-vmaas-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vmaas-rhel9
- RHSA-2026:63385 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.19.4 Async Update
- Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
gitpython-developers GitPython 3.1.58
6 records Highest priority Priority HIGH 1 HIGH, 3 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2026-53322 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-filePriority MEDIUM 64
- TI-2026-53326 GitPython before 3.1.58 Config Injection via option-namePriority MEDIUM 40
- TI-2026-53325 GitPython before 3.1.58 Command Execution via split_single_char_optionsPriority MEDIUM 40
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2026:71210 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:71179 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:71177, RHSA-2026:79378 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:87410 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat OpenShift AI 3.5 | Fixed | RHSA-2026:69539, RHSA-2026:86891 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:68764, RHSA-2026:68771 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:68776, RHSA-2026:68780 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:63385 |
Not affected: 13 products
- Migration Toolkit for Applications 8
- Pen Drive Powered by Red Hat Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Red Hat Hardened Images
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift AI 3.5
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat Satellite 6.19 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-76222
- 2026-10-03 Alias added: GHSA-hmq2-w58f-27jc
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-09 Fix available: RHSA-2026:79378 · Red Hat
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat
- 2026-11-06 Fix available: RHSA-2026:71177 · Red Hat
References
Other 6
- https://github.com/gitpython-developers/GitPython/pull/2202
- https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c
- https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06
- https://github.com/gitpython-developers/GitPython
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58
- https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3784.yaml
More gitpython-developers Gitpython vulnerabilities
- TI-2026-54689 GitPython before 3.1.59 Path Traversal via separate-git-dir CVSS 4.0HIGH 8.7
- TI-2026-51706 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() CVSS 4.0HIGH 8.7
- TI-2026-47618 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from CVSS 4.0HIGH 8.7
- TI-2026-30595 GitPython: Unsafe option check validates multi_options before shlex.split transforms it CVSS 3.1CRITICAL 9.8
- TI-2026-32220 GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository CVSS 4.0HIGH 7.8
- TI-2026-47621 GitPython before 3.1.51 Command Injection via option prefix abbreviation CVSS 4.0HIGH 8.7
Sources
- CVE-2026-76222 · CVE Program
- CVE-2026-76222 · NVD
- FIRST EPSS
- GHSA-hmq2-w58f-27jc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-76222 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences