CVE-2026-114145 · GHSA-83vg-56qc-22m7
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
- Risk score
- 63/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist an…
- Affected
- Gitpython (pip) <= 3.2.0
- Fix
- Upgrade Gitpython to 3.2.1 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
gitpython: Amber, patch this week. Repo.__init__ decides which directory is the git directory by testing candidate paths in an order that considers the real .git last. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name .git, so HEAD, objects/, refs/, config, gitdir, commondir and hooks/ at a repository root…
The flaws
- CVE-2026-114145: GitPython validates a submodule's ".git" path only after cloning into it (RCE) (CVSS 7.5 · EPSS 0%)
- CVE-2026-87817: GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution (CVSS 8.8 · EPSS 0%)
- CVE-2026-87819: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing (CVSS 7.5 · EPSS 1%)
- GHSA-94p4-4cq8-9g67: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573) (CVSS 7.5)
The fix
Upgrade gitpython: 3.2.1 or later on your release line
Who is exposed: gitpython (pip) <= 3.1.59
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-696 (CWE-696). 6 other warnings in 30 days
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| Gitpython | pip | <= 3.2.0 | 3.2.1 |
References
- https://github.com/advisories/GHSA-83vg-56qc-22m7
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7
- https://nvd.nist.gov/vuln/detail/CVE-2026-114145
- https://github.com/gitpython-developers/GitPython/pull/2264
- https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697
- https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1
- https://github.com/advisories/GHSA-83vg-56qc-22m7
Original description
GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1.
Last activity 21 Oct 2026. Patch Forecast updates every hour.