CVE-2026-76222

CVE-2026-76222 is a path-traversal flaw (CWE-22) in the GitPython Python library, which fails to validate submodule names read from a repository's .gitmodules file. It is triggered when GitPython versions before 3.1.58 initialize submodules from a crafted repository whose submodule names contain path-traversal sequences. As a result, an attacker who supplies a malicious repository can cause GitPython to create attacker-controlled Git repositories at arbitrary filesystem paths outside the intended clone directory, producing high integrity impact (per CVSS 4.0) with no confidentiality loss and only low availability impact. Any application, script, or CI/CD automation using GitPython before 3.1.58 to clone or process untrusted repositories is affected. Exploitation has not been confirmed in the wild: a public advisory/PoC reference (GHSA-hmq2-w58f-27jc) exists, the flaw is not in CISA KEV, and EPSS estimates roughly a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade to GitPython 3.1.58 or later via pip. Until patched, avoid using GitPython to initialize submodules from untrusted or attacker-supplied repositories. Also audit hosts where GitPython has processed untrusted repositories for unexpected .git directories created outside the intended clone path.