CVE-2026-76222: GitPython Path Traversal Vulnerability

CVE-2026-76222 Overview

CVE-2026-76222 is a path traversal vulnerability [CWE-22] in GitPython versions prior to 3.1.58. The library fails to validate submodule names read from .gitmodules files during submodule initialization. Attackers can embed directory traversal sequences in submodule names to create Git repositories at arbitrary filesystem locations outside the intended clone directory. Exploitation requires a victim to clone or process a malicious repository using GitPython, which then writes attacker-controlled Git repository content to escaped paths.

Critical Impact
Attackers who deliver a crafted repository can create attacker-controlled Git repositories at arbitrary filesystem paths, enabling integrity compromise of application files, configuration, or automation workflows that depend on GitPython.

Affected Products

GitPython versions prior to 3.1.58
Python applications and CI/CD pipelines that call git.Repo.clone_from or submodule APIs on untrusted repositories
Automated tooling that processes third-party repositories through GitPython

Discovery Timeline

2026-08-19 - CVE-2026-76222 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-76222

Vulnerability Analysis

GitPython processes submodule definitions declared in the .gitmodules file at the root of a repository. Each submodule entry contains a name that GitPython uses when constructing filesystem paths for the submodule's Git metadata. The library treats the submodule name as trusted input and joins it into paths without normalization or containment checks.

When a repository declares a submodule name containing traversal sequences such as ../, GitPython resolves the resulting path outside the parent repository's working directory. During submodule initialization, GitPython creates a .git directory structure at that escaped location. The attacker controls the contents of that Git repository, including hooks, configuration, and references.

The flaw sits in the input validation boundary between repository metadata and filesystem operations. GitPython trusts the .gitmodules file content because Git itself has historically parsed similar structures, but user interaction with a malicious repository is sufficient to trigger the write.

Root Cause

The root cause is missing validation of submodule name strings sourced from .gitmodules. GitPython does not enforce that resolved submodule paths remain within the parent repository directory. The fix in version 3.1.58 adds name validation and path containment checks before performing filesystem operations.

Attack Vector

The attack vector is network-based and requires user interaction. A victim clones or otherwise processes a malicious repository using a vulnerable GitPython version. When submodule initialization runs, GitPython writes Git repository artifacts to the traversal-escaped path. See the GitHub Security Advisory and the VulnCheck Advisory on GitPython for reference details.

No verified public exploit code is available at time of publication.

Detection Methods for CVE-2026-76222

Indicators of Compromise

Unexpected .git directories appearing outside project workspaces after CI jobs or developer clone operations
.gitmodules files containing submodule names with ../ sequences, absolute paths, or backslash separators
New files at paths adjacent to but outside repository roots created by processes running Python and GitPython

Detection Strategies

Scan repositories and CI artifacts for .gitmodules entries where the [submodule "..."] name contains path separators or traversal tokens
Inventory Python environments and identify installations of GitPython at versions below 3.1.58 using pip list or SBOM data
Correlate process telemetry linking python or GitPython-based tooling to filesystem writes outside expected working directories

Monitoring Recommendations

Alert on file creation events writing HEAD, config, or objects/ under directories that are not declared repository roots
Monitor build agents and developer workstations for GitPython invocations against externally sourced repositories
Track dependency drift so that GitPython<3.1.58 reappearing in a lockfile triggers a security review

How to Mitigate CVE-2026-76222

Immediate Actions Required

Upgrade GitPython to version 3.1.58 or later across all Python environments, build agents, and container images
Audit CI/CD pipelines that clone untrusted repositories with GitPython and pause automation until the library is patched
Review recent CI job logs for anomalous filesystem writes that may indicate prior exploitation

Patch Information

The maintainers released a fix in GitPython 3.1.58 that validates submodule names and rejects entries that would resolve outside the parent repository. Refer to the GitHub Security Advisory GHSA-hmq2-w58f-27jc for advisory details and the exact fixed commit.

Workarounds

Avoid processing untrusted repositories with GitPython until the upgrade is deployed
Disable automatic submodule initialization in workflows that call clone_from or Repo.submodule_update on external sources
Run GitPython-based automation inside ephemeral containers with restricted filesystem write scope to contain traversal writes

bash

# Upgrade GitPython to the fixed release
pip install --upgrade 'GitPython>=3.1.58'

# Verify installed version
python -c "import git; print(git.__version__)"

# Identify vulnerable installs across a fleet
pip list --format=freeze | grep -i '^GitPython=='