Incorrect behavior order in GitPython - CVE-2026-114145

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU162631

Incorrect behavior order in GitPython - CVE-2026-114145

Published: November 9, 2026


Vulnerability identifier: #VU162631
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114145
CWE-ID: CWE-696
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows an unauthenticated remote attacker to execute arbitrary code with the victim application's privileges.

The vulnerability exists due to GitPython validating submodule paths only after cloning into the repository's .git directory. An unauthenticated remote attacker can supply a malicious submodule with path .git/hooks to an application accepting untrusted submodule specifications, planting an executable hook when that directory is empty and triggering execution when a victim subsequently performs a checkout.


Affected software

GitPython
Debian Linux
python-git (Debian package)

How to mitigate CVE-2026-114145

Install security update from vendor's website.

GitPython - update to 3.2.1
python-git (Debian package) - update to 3.1.44-1+deb13u1

External References

Related Security Bulletins