Threats tagged 'brew-snakemake-cve-2026-100689'

CVE-2026-100689 is a path traversal vulnerability in GitPython's handling of the .gitmodules 'path' field during submodule updates. The vulnerability allows an attacker to specify a relative path with traversal components (e.g., ../../../tmp/escaped) that can cause files to be written outside the intended repository directory. This occurs because the update() method validates only the submodule name but does not apply the existing path containment guard to the path field before creating directories or checking out submodules. The vulnerability affects Snakemake versions >=5.5.3 and <9.27.0, which bundle GitPython 3.1.61. A fix is available in Snakemake 9.27.0.