CVE-2026-115355 is a vulnerability in the Mistune Markdown parser's Include directive that allows path traversal and cross-site scripting (XSS). The directive does not properly validate file paths, enabling attackers to read arbitrary files via '../' sequences. Additionally, error messages and included file contents are rendered without HTML escaping, causing XSS even when escaping is enabled. This vulnerability affects Mistune versions from 1.8.0 up to but not including 1.10.1. The Include plugin must be explicitly enabled for the vulnerability to be exploitable. A fix is available in version 1.10.1.
Jiratui's GitPython integration has a vulnerability where the create_submodule function clones a submodule into the .git/hooks directory before validating the path, allowing an attacker to plant a malicious executable hook. This hook executes on subsequent git operations, enabling arbitrary code execution. Versions from 3.1.x through 3.2.0+ are affected, with 3.1.x silently planting the hook and 3.2.0+ raising a ValueError only after the malicious hook is already written. The vulnerability requires an attacker-controlled submodule path and an empty or minimal .git/hooks directory.
GitPython's Submodule.move() API does not properly validate intermediate symlinks in the destination path, allowing an attacker-controlled symlink to redirect a submodule move operation outside the parent repository worktree. This can cause the submodule checkout to be moved to an attacker-chosen directory outside the repository, corrupting the parent repository's index and configuration. The issue affects GitPython 3.1.62 and current main branch. No code execution or confidentiality impact is demonstrated.
GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method where an attacker-controlled branch name can be used to perform an arbitrary file read. This occurs because the branch name is passed as a positional argument to git checkout without proper sanitization or argument separation, allowing injection of git options such as --pathspec-from-file. An attacker who can cause the application to clone a repository they control with a malicious default branch name can exploit this to read any file accessible to the application process, such as /etc/passwd. The vulnerability is a partial regression of previous fixes and affects all published releases up to 3.1.62 and the main branch at commit 4905b4af.
GitPython's Remote.pull() method improperly handles the positional refspec argument, allowing an attacker controlling this input to inject a --upload-pack option that bypasses the unsafe-option guard. This leads to arbitrary command execution with the privileges of the calling process when pulling from local-path or SSH transports. The vulnerability arises because the unsafe-option check only inspects keyword arguments, not positional ones, and git pull forwards the refspec to git fetch without a protective '--' separator. Exploitation requires attacker control over the refspec and use of a vulnerable transport, but no additional privileges or user interaction are needed.
GitPython versions >=1.3.0 have three wrapper methods that omit critical unsafe protocol and option checks, leading to potential command injection and remote code execution (RCE). The ls_remote method forwards URLs without checking for unsafe protocols, allowing RCE if the victim's git transport policy permits the 'ext' transport. The merge_base and IndexFile.move methods forward caller arguments without checking for unsafe options, creating latent injection surfaces. These issues are verified on the main branch as of 2026-09-21 and remain unpatched in the latest release 3.1.62. The vulnerability is rated high severity with a CVSS score of 7.5.
Jiratui's GitPython integration has a vulnerability in the parse_actor_and_date() function causing quadratic backtracking on malformed author/committer/tagger lines missing or having malformed trailing epoch or timezone data. This leads to CPU exhaustion when processing crafted commit or tag objects. The issue persists in version 3.1.62 despite a prior fix in 3.1.60 for a related regex. Accessing affected commit or tag fields on malicious objects can cause significant delays, impacting CI tooling, repository scanners, and code-hosting integrations.
GitPython's Repo._clone() method improperly expands environment variables in the separate_git_dir parameter derived from attacker-controlled .gitmodules submodule names. This leads to leakage of environment variable values as directory names on disk and in debug logs when cloning and updating submodules from a malicious repository. The vulnerability arises because Git.polish_url() is called without disabling variable expansion on untrusted input, contrary to other similar call sites. This can expose sensitive environment variables persistently on disk and in verbose logs.
GitPython versions up to 3.1.52 contain a vulnerability where specially crafted submodule names can inject arbitrary configuration directives into the .git/config file. This occurs because section names are not properly escaped, allowing an attacker to inject directives like core.sshCommand, which can lead to remote code execution during subsequent git operations. The vulnerability arises from insufficient sanitization of section names, specifically allowing characters that break the config section header syntax on the same line. A fix is available in version 3.1.53 and later.
The pydantic-settings library's NestedSecretsSettingsSource component improperly follows symbolic links inside a configured secrets directory that point outside this directory, allowing files outside the intended secrets directory to be read into application settings. This behavior bypasses the configured maximum size limit for secrets directories, potentially leading to unintended local file reads and resource exhaustion via cyclic symlinks. The vulnerability affects applications using NestedSecretsSettingsSource with secrets_nested_subdir=True when the secrets directory contains attacker-influenced symlinks. The issue is fixed in pydantic-settings version 1.9.1_1.