{
  "cveId": "CVE-2026-100689",
  "url": "https://patchblox.com/security/cve/CVE-2026-100689",
  "summary": "CVE-2026-100689 is fixed in python-git on 1 platform, first by DEBIAN-CVE-2026-100689, released September 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "python-git: GitPython before 3.1.62 does not validate the \u0060path\u0060 field read from an untrusted .gitmodules file when updating subm...",
  "description": "GitPython before 3.1.62 does not validate the \u0060path\u0060 field read from an untrusted .gitmodules file when updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to constrain the \u0060name\u0060 field, and GitPython\u0027s own containment guard Submodule._to_relative_path() is applied in add() and move(), Submodule.update() derives the absolute checkout location from the raw \u0060path\u0060 value without that guard. A .gitmodules entry containing directory traversal components (e.g., path = ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the repository working tree, populated from the submodule URL on the clone path, and removed via shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62.",
  "published": "2026-09-26T14:16:53Z",
  "severity": "",
  "epss": 0.00401,
  "epssPercentile": 0.34652,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "python-git",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.1.30-1\u002Bdeb12u3",
      "fix": "DEBIAN-CVE-2026-100689",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-100689",
      "released": "2026-09-27T20:04:15Z"
    },
    {
      "platform": "linux",
      "product": "python-git",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.1.44-1\u002Bdeb13u1",
      "fix": "DEBIAN-CVE-2026-100689",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-100689",
      "released": "2026-09-27T20:04:15Z"
    },
    {
      "platform": "linux",
      "product": "python-git",
      "release": "Debian 14",
      "fixedVersion": "3.1.62-1",
      "fix": "DEBIAN-CVE-2026-100689",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-100689",
      "released": "2026-09-27T20:04:15Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}