PyPI/gitpython CVE-2026-100689: medium 5.9, EPSS 0.40%

GitPython submodule update path traversal can write outside the repository

Action: Upgrade gitpython to 3.1.62 or later.

pip install gitpython==3.1.62

Affected

Fixed versions

Sources

• osv: GHSA-59cr-6r3x-644w
• nvd: CVE-2026-100689
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w
• https://github.com/gitpython-developers/GitPython/pull/2225
• https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093
• https://github.com/gitpython-developers/GitPython
• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.62

CVE-2026-100689 · published 2026-09-30T23:47:12Z · modified 2026-10-01T00:00:05.754996881Z · JSON