[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
gitpython (changelog)	==3.1.62 → ==3.2.1

---

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

CVE-2026-114145 / GHSA-83vg-56qc-22m7

More information

Details

Summary

create_submodule(name, path, url) clones a submodule into the repo's own .git
directory before it rejects the path. A path of ".git/hooks" is accepted by the
pre-clone check, so the submodule is cloned straight into the live hooks directory,
and a file named post-checkout in the submodule becomes an executable
.git/hooks/post-checkout. On 3.2.0+ the later index check does raise ValueError,
but only after the clone already wrote to disk, and it does not remove the planted
hook; on 3.1.x there is no such check and the call succeeds silently. Either way the
hook runs on the next git operation (e.g. checkout), giving code execution.

Details

The checkout path is validated too late, after the clone has already mutated disk.
This breaks the "validate before mutation" invariant that commit 43a43cd8 ("Validate
submodule checkout and metadata paths before mutation") set out to enforce.

Submodule.add() calls the permissive path check before cloning, and the strict check
only reaches the ".git" alias at index time, after _clone_repo has written to disk:

git/objects/submodule/base.py (Submodule.add)
599: path = cls._to_relative_path(repo, path) # accepts ".git/hooks"
673: mrepo = cls._clone_repo(repo, url, path, name, ...) # clones into /.git/hooks
714: index.add([sm], write=True) # strict check only triggers here

git/index/base.py (IndexFile._preprocess_add_items)
732: _validate_repo_path(entry.path) # rejects ".git", too late

_to_relative_path only blocks ../absolute/out-of-tree paths; .git aliases are
rejected only by _validate_repo_path, which was added in 3.2.0 (commit a75aedf3) and
runs at the index boundary. The ValueError it raises at line 732 does not roll back
what _clone_repo already wrote.

Version-dependent behavior:

• 3.2.0 .. tip bda18e08: _validate_repo_path raises ValueError at index.add, but the
  hook is already on disk and is not removed (incorrect order of validation vs. clone).
• 3.1.x (e.g. 3.1.59): _validate_repo_path does not exist and _to_relative_path does
  not reject .git; create_submodule(path=".git/hooks", ...) returns with no error at
  all and the hook is planted silently.

Proof of concept

Setup:
evilsub/ : a git repo whose ROOT contains an executable file named post-checkout (the payload)
victim/ : a git repo with at least 1 commit and a second branch, whose .git/hooks has NO
sample hooks (the state of a minimal/CI checkout, or git init with an empty
template dir, or GIT_TEMPLATE_DIR/init.templateDir empty)

import git, os.path as osp
try:
git.Repo("victim").create_submodule(name="x", path=".git/hooks", url=osp.abspath("evilsub"))
except ValueError:
pass # 3.2.0+: ".git" is rejected, but only AFTER the clone, so the plant already happened.
# 3.1.x: no exception is raised at all; the call succeeds and still plants the hook.

victim/.git/hooks/post-checkout now exists, mode 0755, attacker-controlled, on every

affected version. Any later checkout runs it:

git -C victim checkout -> the hook runs -> code execution

Verified live:

• tip bda18e08 (3.2.0 + 3 commits): create_submodule raised ValueError from
  git/index/base.py:732, yet .git/hooks/post-checkout was present and executable, and
  git checkout executed it.
• 3.1.59: create_submodule returned with no error; .git/hooks/post-checkout was planted
  and executed by git checkout.

Impact

Arbitrary code execution. A library/app that creates a submodule from an
attacker-influenced path ends up with an attacker-controlled executable in
.git/hooks, which git runs on ordinary later operations. This affects any service
that derives a submodule checkout path from untrusted data, e.g. one that ingests a
submodule spec (name/path/url) from a user-supplied manifest or API request and feeds
path into create_submodule. On 3.2.0+ the library's own validation is the thing that
fails: it correctly rejects the .git path, but only after the submodule has already
been cloned into place, so an app that traps the ValueError reasonably believes the
unsafe path was blocked.

Preconditions (hence AC:H): (1) the app passes an attacker-influenced submodule path;
(2) the target hook name is free in .git/hooks, true for minimal/CI/container
checkouts and whenever init.templateDir/GIT_TEMPLATE_DIR is empty. With the default
sample hooks present, git clone refuses the non-empty destination and no plant occurs.

Affected: all tested versions from 3.1.x (3.1.59) through the current tip bda18e08
(3.2.0 + 3 commits). 3.1.x plants silently; 3.2.0+ plants despite raising ValueError.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7
• https://nvd.nist.gov/vuln/detail/CVE-2026-114145
• https://github.com/gitpython-developers/GitPython/pull/2264
• https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697
• https://github.com/gitpython-developers/GitPython
• https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

gitpython-developers/GitPython (gitpython)

v3.2.1

Compare Source

What's Changed

• prepare for next release, v3.2 by @​Byron in #​2260
• objects: decode a byte mode before reading its digits by @​SashaMIT in #​2261
• build(deps): bump https://github.com/astral-sh/ruff-pre-commit from v0.16.5 to 0.16.9 in the pre-commit group by @​dependabot[bot] in #​2263
• fix(submodule): validate destinations before mutation by @​Byron in #​2264
• fix(util): create lock files in one exclusive step by @​radhika1314 in #​2267
• fix(commit): accumulate gpgsig continuation lines in linear time by @​Keerthana-64 in #​2268
• fix(index): accept a single PathLike in checkout by @​kokotatan in #​2269
• fix(util): redact URL credentials without corrupting the host by @​yunaremaia in #​2270
• change line for changelogs by @​CrowZhen in #​2272
• fix(commit): reject identity fields that alter commit headers by @​Keerthana-64 in #​2271
• fix: stop stalled remote commands when their timeout expires by @​Byron in #​2277
• fix(util): reject symbolic links that alias .gitmodules by @​Keerthana-64 in #​2278
• fix: send one object name or path per git stdin record by @​Keerthana-64 in #​2279
• fix(stats): preserve whitespace in filenames by @​v1shay in #​2280
• fix(config): preserve exact large integer values by @​xiehuanyi in #​2281
• fix: resolve IterableList names independently of list attributes by @​FanWu-ai in #​2283
• fix relative blocking lock 2026101 by @​Byron in #​2284

New Contributors

• @​SashaMIT made their first contribution in #​2261
• @​kokotatan made their first contribution in #​2269
• @​yunaremaia made their first contribution in #​2270
• @​CrowZhen made their first contribution in #​2272
• @​v1shay made their first contribution in #​2280
• @​xiehuanyi made their first contribution in #​2281
• @​FanWu-ai made their first contribution in #​2283

Full Changelog: gitpython-developers/GitPython@3.2.0...3.2.1

v3.2.0: - Security

Compare Source

What's Changed

• test: cover subdirectory discovery and pathspec commands in bare-repository worktrees by @​christianvuerings in #​2228
• Read git's yes/no and on/off booleans in get_value by @​rawsun007 in #​2229
• Clarify detached HEAD access and isolate test branch state by @​Byron in #​2231
• Reject submodule move destinations through intermediate symlinks by @​Byron in #​2232
• fix: validate checkout positional reference options by @​Byron in #​2233
• Fix timeout child-process lookup on non-GNU systems by @​aprylewu in #​2236
• Preserve implicit boolean config keys by @​Byron in #​2238
• Reject comments after implicit boolean config keys by @​Byron in #​2239
• Fix case-insensitive Git config name matching by @​Byron in #​2241
• Move project metadata to pyproject.toml by @​mwtoews in #​2242
• Move [doc] extra to a PEP 735 dependency group; add uv-sync CI check by @​mwtoews in #​2243
• fix: strip inline config comments the way git does by @​rawsun007 in #​2245
• Drop Python 3.7 by @​mwtoews in #​2246
• fix: preserve positional operands in high-level Git commands by @​Byron in #​2247
• submodule: option to update without fetching by @​jeffro256 in #​2244
• bump minor version to indicate drop of python 3.7 support by @​Byron in #​2248
• fix: skip a UTF-8 BOM when reading config files by @​geek-alpha in #​2249
• fix: complete safety checks in Git command wrappers by @​Byron in #​2251
• build(deps): bump astral-sh/setup-uv from 10.1.0 to 10.2.0 by @​dependabot[bot] in #​2252
• fix: bound actor and date parsing by @​Byron in #​2253
• fix(repo): preserve literal separate Git directory paths by @​Byron in #​2255
• fix: validate object types when loading binary SHAs by @​Byron in #​2256
• fix(commit): bound co_authors trailer parsing by @​Keerthana-64 in #​2257
• various fixes by @​Byron in #​2258
• fix(config): bound option-line parsing by @​radhika1314 in #​2259

New Contributors

• @​christianvuerings made their first contribution in #​2228
• @​rawsun007 made their first contribution in #​2229
• @​aprylewu made their first contribution in #​2236
• @​mwtoews made their first contribution in #​2242
• @​jeffro256 made their first contribution in #​2244
• @​geek-alpha made their first contribution in #​2249
• @​Keerthana-64 made their first contribution in #​2257
• @​radhika1314 made their first contribution in #​2259

Full Changelog: gitpython-developers/GitPython@3.1.62...3.2.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.