CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.58 are vulnerable due to inadequate validation of submodule names in .gitmodules files, enabling attackers to exploit this flaw to create Git repositories at arbitrary filesystem paths outside the designated clone directory. This vulnerability poses a significant risk as it allows for the creation of attacker-controlled repositories in unintended locations, potentially leading to unauthorized access or data manipulation. Organizations using GitPython should prioritize updating to the latest version to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations.
Related CVEs
Other vulnerabilities affecting the same vendor(s)