CVE-2026-114145

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.2.1

Description The create submodule() function in git/objects/submodule/base.py accepts an attacker-influenced submodule path and invokes clone repo() before rejecting the destination. In versions 3.1.x, the validate repo path() function is missing, causing the call to succeed silently. In version 3.2.0 and subsequent affected revisions, the check in git/index/base.py raises a ValueError only after the clone has written to disk without removing the planted file. This allows an attacker-controlled submodule to place an executable post-checkout hook that is executed during a later Git operation. Exploitation occurs when an application accepts an untrusted submodule path and a clone destination, such as .git/hooks, that is empty enough for Git to clone into.

Recommendations Update to version 3.2.1.