Threats tagged 'ghsa-cw5h-x3x9-4mwp'

GitPython versions before 3.1.62 contain a path traversal vulnerability in the handling of the `path` field from untrusted .gitmodules files during submodule updates. This flaw allows directory creation outside the repository working tree, potentially leading to unauthorized file system modifications. The vulnerability requires an application flow that updates submodules at a non-HEAD commit, which is less common. The issue is fixed in GitPython 3.1.62.