CVE-2026-76222EPSS p34.3%

CVE-2026-76222CVE-2026-76222

gitpython_project / gitpython

Description

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.

Scoring

CVSS 8.2 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
EPSS0.42% probability of exploitation · percentile 34.3% · 2026-10-05T12:00:23Z
Last modified2026-09-02
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.