CVE-2026-114145: GitPython validates a submodule's ".git" path only after cloning into it (RCE)
GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo() before safely rejecting the destination. In 3.1.x, validaterepopath() does not exist and the call succeeds silently, while in 3.2.0 and later affected revisions the check in git/index/base.py raises ValueError only after the clone has written to disk and does not remove the planted file. An attacker-controlled submodule can therefore place an executable post-checkout hook that a later Git operation executes. Exploitation requires an application to accept an untrusted submodule path and a clone destination such as .git/hooks that is empty enough for Git to clone into it, which commonly means that default sample hooks are absent. This issue is fixed in version 3.2.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.2.1
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments using GitPython before 3.2.1 are exposed if they call create_submodule() with an attacker-influenced submodule path. Exploitation also depends on the clone destination, such as .git/hooks, being empty enough for Git to clone into it; default sample hooks commonly prevent that condition.
Does an attacker need credentials or direct server access?
No privileges are required, but user interaction is required according to the supplied severity vector. The attacker must be able to influence a submodule path accepted by the application and cause it to target a suitable destination such as .git/hooks.
What is the impact of the delayed validation behavior?
A malicious submodule can place an executable post-checkout hook in the repository metadata directory. A later Git operation may execute that hook, resulting in remote code execution.
Are versions that raise ValueError still affected?
Yes. In affected 3.2.0 and later revisions, the validation occurs after cloning has already written files to disk, and the raised ValueError does not remove a planted file. In 3.1.x, the relevant validation does not exist and the operation succeeds silently.
What is the remediation?
Upgrade GitPython to version 3.2.1, which fixes the issue. Until upgrading, do not pass untrusted submodule paths to create_submodule(), and inspect repository .git/hooks directories for unexpected files if untrusted paths may already have been processed.