CVE-2026-76222

The record

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.

Affected packages

Related vulnerabilities

• CVE-2026-47256 OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability… CWE-22
• CVE-2026-75604 Next.js is a React framework for building full-stack web applications. CWE-22
• CVE-2026-32637 Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster… CWE-22
• CVE-2026-79676 NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that… CWE-22
• CVE-2026-78677 GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing… CWE-22
• CVE-2026-63312 NLTK before 3.10.0 contains an arbitrary local file read vulnerability in… CWE-22
• CVE-2026-71514 NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader. CWE-22
• CVE-2026-44517 Buildah is a tool that facilitates building OCI images. CWE-22