CVE-2026-76222
Last modified
CVE-2026-76222 is a high-severity vulnerability rated 8.2/10 on the CVSS scale. GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitpython Project | Gitpython | < 3.1.58 |
References
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jcExploit, Vendor Advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jcExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-76222?
How severe is CVE-2026-76222?
How do I fix CVE-2026-76222?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-76216Vikunja through 2.4.0 contains a principal-type confusion vu…7.5
- CVE-2026-76217GitPython versions before 3.1.58 fail to validate options pa…6.5
- CVE-2026-76218GitPython before 3.1.58 contains a remote code execution vul…8.8
- CVE-2026-76219GitPython versions before 3.1.58 contain an arbitrary file o…8.1
- CVE-2026-76220GitPython before 3.1.58 contains a command execution vulnera…8.8
- CVE-2026-76221GitPython before 3.1.58 contains a config-name injection vul…8.8
- CVE-2026-76223ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to …7.1
- CVE-2026-76224ArcadeDB before 26.8.1 (arcadedb-gremlin, affected <= 26.7.3…8.8
- CVE-2026-76225ArcadeDB before 26.8.1 contains a server-side request forger…7.7
- CVE-2026-76226Renovate versions from 43.65.0 before 43.102.11 contain a re…6.3
- CVE-2026-76227Renovate versions from 42.68.1 before 42.96.3 (and from 42.6…5.5
- CVE-2026-76228Renovate versions >=32.124.0 and before 42.68.5 (and Mend re…6.7
Are you affected by CVE-2026-76222?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST