Kimi cli: GitPython submodule update path traversal can write outside the repository (CVE-2026-100689)

GitPython versions 3.1.61 and main branch contain a path traversal vulnerability in the submodule update functionality. While the submodule name is validated to prevent traversal, the 'path' field from the .gitmodules file is used without applying the existing _to_relative_path containment guard. This allows an attacker to specify a path with '../' components, causing os.makedirs() and subsequent operations to affect directories outside the repository working tree. The vulnerability is mitigated in typical clone flows because real git refuses to check out trees with '..' components, but it can be triggered when updating submodules at non-HEAD commits via API calls. The recommended fix is to apply the containment guard to the 'path' field wherever it is consumed, preventing directory traversal. This vulnerability is distinct from a prior fix (GHSA-hmq2-w58f-27jc) which only addressed the submodule name.

An attacker able to supply a crafted .gitmodules file with a malicious 'path' value containing directory traversal sequences can cause GitPython to create directories and write files outside the repository working tree during submodule update operations. This could lead to unauthorized file system modifications outside the intended repository scope. However, the vulnerability requires the victim's code to update submodules at a non-HEAD commit, which is not the common usage pattern, limiting the practical impact. There are no known exploits in the wild.

A patch is available that applies the existing _to_relative_path containment guard to the 'path' field during submodule update operations, preventing directory traversal. Users should update GitPython to a fixed version that includes this validation. Additionally, validating the 'path' field at the boundary when reading .gitmodules entries to reject absolute paths or those containing '..' components is recommended. Until patched, avoid using submodule update operations on non-HEAD commits with untrusted .gitmodules files.