GitPython versions from 2.1.0 up to but not including 2.24.3 contain a vulnerability where an attacker-controlled submodule name in a cloned repository's .gitmodules file can cause GitPython to create and initialize a Git repository outside the intended working directory. This occurs because GitPython does not validate submodule names for directory traversal sequences before using them to construct filesystem paths. The vulnerability is fixed in version 2.24.3.