Vulnerabilities

Security fix · GHSA-gq48-pqfc-9p58

GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree

Published Oct 27, 2026 · catalog updated Oct 27, 2026 · GitPython: Submodule.move() follows an

Last checked Oct 27, 2026, 12 days ago.

Open the advisory

Exploitation likelihood is not on this record for GHSA-gq48-pqfc-9p58. A missing EPSS score is not a low risk. Compare GitPython: Submodule.move() follows an with the linked advisory before you change production.

Severity

Medium—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

pip GitPython

## Summary GitPython's public API verifies that its destination is lexically inside the parent repository, but it does not reject symbolic links in the destination's intermediate components before filesystem operations. On systems that check out Git symlinks, an untrusted repository can therefore redirect a fixed, application-selected move destination outside the parent worktree. The reporter reproduced this on the latest release, GitPython 3.1.62, and current . In the strict scenario, the repository commits , while the consuming application independently passes the fixed literal . follows , moves the initialized submodule checkout to , rewrites and the index to the symlinked path, and leaves the index unable to produce a tree. The same result occurs when the committed symlink contains an absolute path to an external directory. No attacker-controlled API argument, local symlink planting, race, Git hook, unsafe-option flag, or network access during the proof is required. ## Trust boundary and preconditions The attacker controls: - an untrusted Git repository that the application clones; - a mode- tracked symlink named ; - the initialized submodule's content. The consuming application controls the call and uses a fixed layout rule: The trigger requires the application to initialize the submodule and later call with a path below the attacker-committed symlink. Ordinary clone or submodule update does not automatically make this call. Windows was not tested. The primitive applies where Git materializes the tracked entry as a real symlink; on Windows that generally requires with Developer Mode or sufficient privilege. Configurations that materialize it as an ordinary file do not take this path. ## Product and directly verified revisions - Package: ( ecosystem) - Latest release: 3.1.62, tag commit - Current : - Relevant SHA-256 in both revisions: - Upstream state rechecked: 2026-09-10 KST Only these two revisions were directly tested. ## Severity and weakness The demonstra