Detections
Analytics

Echo: python-git: security update to 3.1.62

high Tenable Self-Hosted Container Security Plugin ID 474837

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when
 updating submodules. While a prior fix (GHSA-hmq2-w58f-27jc) added Submodule._validated_name() to
 constrain the `name` field, and GitPython's own containment guard Submodule._to_relative_path() is applied
 in add() and move(), Submodule.update() derives the absolute checkout location from the raw `path` value
 without that guard. A .gitmodules entry containing directory traversal components (e.g., path =
 ../../../tmp/escaped) can therefore cause directories to be created via os.makedirs() outside the
 repository working tree, populated from the submodule URL on the clone path, and removed via
 shutil.rmtree() when force_remove is used. Exploitation requires an application flow that updates
 submodules at a non-HEAD commit (such as a historical-commit API); the common clone-then-update flow re-
 derives the path from a canonical tree lookup and is not affected. The issue is fixed in GitPython 3.1.62.
 (CVE-2026-100689)

Solution

Update the python-git library and its related packages to version 3.1.62 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-100689

Plugin Details

Severity: High

ID: 474837

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.47

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:P

CVSS Score Source: CVE-2026-100689

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/14/2026

Vulnerability Publication Date: 9/26/2026

Reference Information

CVE: CVE-2026-100689