Threats tagged 'brew-cruft-cve-2026-100689'

CVE-2026-100689 is a path traversal vulnerability in GitPython 3.1.61 and main branch affecting the submodule update process. The vulnerability arises because the 'path' field from .gitmodules is used without proper validation, allowing an attacker to specify a path outside the repository directory. This can lead to directory creation and population outside the intended repository location. The issue is mitigated in common workflows since real git rejects .gitmodules with '..' components in the working tree, but it can be triggered when updating submodules at non-HEAD commits. A fix is available in version 2.16.0_16.