SB2026110960 - Incorrect behavior order in GitPython

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110960

SB2026110960 - Incorrect behavior order in GitPython

Published: November 9, 2026

Security Bulletin ID SB2026110960
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Incorrect behavior order (CVE-ID: CVE-2026-114145)

CWE-ID: CWE-696 - Incorrect Behavior Order

CVSSv4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary code with the victim application's privileges.

The vulnerability exists due to GitPython validating submodule paths only after cloning into the repository's .git directory. An unauthenticated remote attacker can supply a malicious submodule with path .git/hooks to an application accepting untrusted submodule specifications, planting an executable hook when that directory is empty and triggering execution when a victim subsequently performs a checkout.


Remediation

Install update from vendor's website.

References