GitPython's Submodule.move() API does not properly validate symbolic links in the destination path, allowing an attacker-controlled symlink to redirect submodule moves outside the parent repository worktree. This can cause the submodule checkout to be moved to an unintended external directory, corrupting the parent repository's index and configuration. The vulnerability requires an attacker to supply a malicious Git repository with a symlinked path and the application to call Submodule.move() on a path beneath that symlink. No code execution or confidentiality impact is demonstrated, but the integrity of the repository is compromised.
GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method that allows an attacker to read arbitrary files on the system by controlling the branch name. This occurs because the branch name, passed as a positional argument, is not properly sanitized and can inject unsafe git checkout options such as --pathspec-from-file, leading to disclosure of sensitive files like /etc/passwd. The vulnerability arises from an incomplete fix of prior advisories that only guarded keyword arguments but missed positional argument checks in Head.checkout().
GitPython's Remote.pull() method improperly handles the positional refspec argument, allowing an attacker to inject a malicious --upload-pack option that bypasses the unsafe-option guard. This leads to arbitrary command execution with the privileges of the calling process when using local-path or SSH transports. The vulnerability affects Snakemake versions from 7.20.0 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1.
CVE-2026-110857 is a vulnerability in Snakemake's use of GitPython where three Git command wrapper methods omit critical checks for unsafe protocols and options. This omission allows potential remote code execution (RCE) when using the ls_remote method with certain git transport protocols, specifically the 'ext' transport if permitted by the victim's git configuration. The merge_base and IndexFile.move methods also forward caller-controlled arguments without proper sanitization, creating latent injection surfaces. The vulnerability affects Snakemake versions from 5.5.3 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1.
Snakemake's use of GitPython contains a regex vulnerability in the parse_actor_and_date function that causes quadratic backtracking on malformed author/committer/tagger identity lines missing or having malformed trailing epoch or timezone data. This results in CPU exhaustion when processing crafted commit or tag objects with long malformed identity lines. The issue affects Snakemake versions from 5.5.3 up to but not including 9.27.0_1. A fix is available in version 9.27.0_1 that modifies the regex to prevent backtracking.
GitPython's _clone() method improperly expands environment variables in the separate_git_dir parameter derived from attacker-controlled .gitmodules submodule names. This leads to leakage of environment variable values as directory names on disk and in debug logs when cloning and updating submodules from a malicious repository. The flaw affects GitPython versions from 5.5.3 up to but not including 9.27.0_1 and has been fixed in 9.27.0_1.
Snakemake's use of GitPython allows an attacker to execute arbitrary code by creating a submodule with a path that points to the .git/hooks directory. This causes an attacker-controlled executable hook to be planted and run on subsequent git operations. Versions from 5.5.3 up to but not including 9.27.1 are affected. Although versions 3.2.0 and later raise a ValueError after cloning, the malicious hook remains on disk and executable. This vulnerability enables remote code execution if an attacker can influence the submodule path parameter.
CVE-2026-100689 is a path traversal vulnerability in GitPython's handling of the .gitmodules 'path' field during submodule updates. The vulnerability allows an attacker to specify a relative path with traversal components (e.g., ../../../tmp/escaped) that can cause files to be written outside the intended repository directory. This occurs because the update() method validates only the submodule name but does not apply the existing path containment guard to the path field before creating directories or checking out submodules. The vulnerability affects Snakemake versions >=5.5.3 and <9.27.0, which bundle GitPython 3.1.61. A fix is available in Snakemake 9.27.0.
GitPython versions prior to 3.2.0 contain a Regular Expression Denial of Service (ReDoS) vulnerability in the Actor.name_email_regex pattern used to parse commit author and committer fields. The regex can cause catastrophic backtracking when processing a commit object with a long author or committer string containing an unterminated '<' character, leading to quadratic CPU exhaustion. This can result in denial of service conditions in any service or tool that reads commit metadata via GitPython, including CI runners and repository scanners.
GitPython versions from 5.5.3 up to but not including 9.26.0 contain a vulnerability where the repository's git directory is misresolved. This allows attacker-controlled repository content to impersonate the git directory, leading to arbitrary code execution when a victim performs a commit using GitPython. The flaw arises because GitPython tests candidate paths for the git directory in an order that considers the real .git directory last, enabling tracked files named gitdir, commondir, and HEAD to mislead the resolution. This can also lead to unauthorized reading of files outside the repository and writing config files to attacker-chosen locations. The issue is fixed in version 9.26.0.
GitPython 3.1.59 contains a vulnerability in its high-level diff API where the --no-index option bypasses protections against unsafe git diff options. This allows an attacker who can influence diff options and paths to use a blind local-file content oracle to infer contents of local files accessible to the GitPython process. The issue arises because --no-index treats path arguments as arbitrary filesystem paths, and when combined with the -I/--ignore-matching-lines option, it creates a content-dependent Boolean oracle. This vulnerability was confirmed in version 3.1.59 and is fixed in version 9.26.0 of the affected product, snakemake. Exploitation requires the embedding application to expose success/error distinctions and allow repeated queries with attacker-controlled inputs.
GitPython versions up to 3.1.58 contain a vulnerability in TagReference.create() where a positional argument 'reference' can bypass the unsafe option guard for '--file', allowing an attacker to read arbitrary local files. This occurs because the guard only inspects keyword arguments, not positional ones, enabling injection of '--file=<path>' as a positional argument. The file contents are returned in the annotated tag message. The issue is fixed in version 9.25.2.
GitPython versions up to 3.1.58 have an incomplete denylist for unsafe git revision options in the Repo.blame() and Repo.blame_incremental() methods. The denylist blocks file-write options but omits the --contents and -S options, which allow reading arbitrary local files. An attacker controlling the revision argument can cause the blame result to include contents of arbitrary files accessible by the host process. This vulnerability allows local file read at the privileges of the application using GitPython.
GitPython versions from 5.5.3 up to but not including 9.25.2 have a vulnerability where the clone_from() and clone() methods do not block the --separate-git-dir option by default. This option allows redirecting the repository's .git metadata directory to an arbitrary filesystem path controlled by the caller. As a result, an attacker able to supply this option can cause GitPython to create repository metadata outside the intended clone destination, potentially planting files or directories at arbitrary locations permitted by filesystem permissions.
CVE-2026-78676 is a critical vulnerability in GitPython's GitConfigParser affecting multi-line git-config values. The issue arises because multi-line values read from disk are re-serialized incorrectly, causing dormant config lines to be interpreted as active injected directives. This can lead to arbitrary code execution via the core.hooksPath configuration, which controls Git hook execution paths. The vulnerability affects GitPython versions from 5.5.3 up to but not including 9.25.2 and is fixed in version 9.25.2.
GitPython versions from 5.5.3 up to but not including 9.25.2 contain a vulnerability where the SubmoduleConfigParser used to parse the .gitmodules file follows [include] directives by default. Since .gitmodules is attacker-controlled in cloned repositories, this allows an attacker to cause the parser to read arbitrary local files. When the included file is not a valid git-config format, the parser raises an exception that leaks the first line of the file in the error message. This leads to local file content disclosure of the first line of any readable file on the victim system during common read-only operations like enumerating submodules.
GitPython versions prior to 9.25.1 contain a vulnerability where an attacker-controlled submodule name in a cloned repository's .gitmodules file can cause GitPython to create and initialize a Git repository outside the intended working directory. This occurs because GitPython does not validate submodule names for directory traversal sequences, unlike core Git which blocks this attack. The vulnerability requires the victim to clone a malicious repository and run submodule initialization via GitPython.
GitPython versions up to 3.1.57 contain a vulnerability in the config-name validator that fails to properly sanitize option names. This allows injection of arbitrary git configuration directives such as core.sshCommand or core.hooksPath by embedding special characters (=, #, whitespace) in option names. As a result, an attacker controlling the option name can cause remote code execution on the next git operation. The issue arises because the validation logic applies strict checks only to section names, not option names, allowing malicious input to be written verbatim into the config file.
GitPython versions up to 3.1.57 contain a vulnerability where the unsafe git option guard can be bypassed by using the 'split_single_char_options=False' parameter combined with a single-character keyword argument. This bypass allows arbitrary OS command execution via the '--upload-pack' git option, despite the default safety setting 'allow_unsafe_options=False'. The flaw is due to incomplete validation of joined short-option tokens, enabling command injection in methods like clone, fetch, pull, and others that forward kwargs.
GitPython versions up to 3.1.57 contain a vulnerability in the IndexFile.from_tree, reset, and merge_tree methods where unguarded forwarding of positional treeish arguments to git read-tree allows an attacker to overwrite arbitrary files with a valid git-index blob. This occurs because the methods do not check or block unsafe options like --index-output, enabling an attacker to specify an arbitrary output path. The impact is arbitrary file overwrite at the privileges of the host process, potentially corrupting or destroying important files. A fix is available in version 9.25.1 that adds guards against unsafe options and places a separator to prevent option injection.