7.5

CVE-2026-114145: GitPython validates a submodule's ".git" path only after cloning into it (RCE)

Awaiting analysis
AliasesGHSA-83vg-56qc-22m7DEBIAN-CVE-2026-114145CGA-4mc4-35hm-h98p
Published 21-10-2026Last modified 23-10-2026

Vulnerability summary

CVE-2026-114145 is a high (CVSS 7.5) Incorrect Behavior Order vulnerability in gitpython-developers gitpython. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 36.6% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.42%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:12391-1

Timeline

  1. 21-10-2026
    PublishedVulnerability first disclosed.
  2. 23-10-2026
    Last modifiedVulnerability information updated.

Description

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the destination. In 3.1.x, _validate_repo_path() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.42%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

22-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard11 products
  • awxAll versions (No fix recorded) | < 24.6.1-r75
  • nemo-gym< 0.5.0_rc0_git20260729-r10
  • nemo-rl-cuda-13.0All versions (No fix recorded) | < 0.7.0-r20
  • nemo-rl-cuda-13.0-automodelAll versions (No fix recorded) | < 0.7.0-r20
  • nemo-rl-cuda-13.0-mcore< 0.7.0-r20
Debian1 product
  • python-gitAll versions (No fix recorded) | < 3.1.30-1+deb12u3 | < 3.1.44-1+deb13u1 | < 3.2.1-1
Gitpython-developers1 product
PyPI1 product
  • gitpython< 3.2.1
Ubuntu1 product
  • python-gitAll versions (No fix recorded)

5 vendors · 15 products

References

10 links