This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-76222 →

DEBIAN-CVE-2026-76222

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesyste...

Original description

The description as published by the source.

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.61-1"}]}]

References

advisory security-tracker.debian.org