StackRadar

CVE-2026-100689

Medium

Advisory

Published 30 Sept 2026In the index since 1 Oct 2026
Severity
Medium
worst across findings
CVSS
6.1
base score, highest
EPSS
0.004
32nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
53
of 18,087 indexed, latest versions
Container images
60
deployed by those charts
Fix available
1 of 1
affected package

GitPython submodule update path traversal can write outside the repository

Carried by container images the latest versions of 53 of 18,087 indexed charts deploy, on 60 images.

Affected packageAffected versionsFixed inImages
gitpythonpypi3.1.0, 3.1.7, 3.1.11, 3.1.17+18 more3.1.6260
OSV records
GHSA-59cr-6r3x-644w

Charts affected

53 by stars
ChartLatestAffected imagesRadar Score
mlflowcommunity-chartsVerified publisher1.11.71 of 1See more

mlflow community-charts 1.11.7

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
burakince/mlflow:3.16.0ab4b566644b9
gitpython@3.1.61
3.1.62

Open the chart page →

1,043
difydify-helmVerified publisher0.38.01 of 11See more

dify dify-helm 0.38.0

1 of the 11 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
langgenius/dify-api:1.16.1dcefa5f7c47c
gitpython@3.1.54
3.1.62

Open the chart page →

74,916
ambassadordatawire6.9.51 of 2See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
gitpython@3.1.11
3.1.62

Open the chart page →

5,565
emissary-ingressdatawire7.1.8-ea1 of 1See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
datawire/emissary:2.0.2-ea9716efbdd24b
gitpython@3.1.11
3.1.62

Open the chart page →

6,231
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
gitpython@3.1.11
3.1.62

Open the chart page →

6,661
stackstorm-hastackstormVerified publisher1.1.011 of 17See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
gitpython@3.1.37
3.1.62
stackstorm/st2api:3.86f56d239d280
gitpython@3.1.37
3.1.62
stackstorm/st2auth:3.833ecfda16608
gitpython@3.1.37
3.1.62
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
gitpython@3.1.37
3.1.62
stackstorm/st2notifier:3.8f190a6212195
gitpython@3.1.37
3.1.62
stackstorm/st2rulesengine:3.8259503496ff9
gitpython@3.1.37
3.1.62
stackstorm/st2scheduler:3.8b1de2055c362
gitpython@3.1.37
3.1.62
stackstorm/st2sensorcontainer:3.8b1a338f64773
gitpython@3.1.37
3.1.62
stackstorm/st2stream:3.81c8904a3bf67
gitpython@3.1.37
3.1.62
stackstorm/st2timersengine:3.81bf35bfaf00c
gitpython@3.1.37
3.1.62
stackstorm/st2workflowengine:3.819fdfffdbba8
gitpython@3.1.37
3.1.62

Open the chart page →

751,017
nautobotnautobotOfficialVerified publisher3.1.21 of 1See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
gitpython@3.1.46
3.1.62

Open the chart page →

5,214
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
gitpython@3.1.41
3.1.62

Open the chart page →

17,361
mlflowgetindataVerified publisher0.1.21 of 1See more

mlflow getindata 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
gitpython@3.1.43
3.1.62

Open the chart page →

2,655
squestchristianhuthVerified publisher6.6.81 of 4See more

squest christianhuth 6.6.8

1 of the 4 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
gitpython@3.1.43
3.1.62

Open the chart page →

12,227
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
gitpython@3.1.42
3.1.62

Open the chart page →

12,940
weblatedeliveryheroVerified publisher0.3.21 of 3See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
gitpython@3.1.7
3.1.62

Open the chart page →

10,735
deepstackgeek-cookbookVerified publisher1.5.21 of 2See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
robmarkcole/deepstack-ui:latest410275726459
gitpython@3.1.18
3.1.62

Open the chart page →

7,069
helmuphelmupVerified publisher0.1.02 of 3See more

helmup helmup 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
gitpython@3.1.40
3.1.62
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
gitpython@3.1.40
3.1.62

Open the chart page →

18,788
mlflow-controllermlflow-deployment-controller0.1.82 of 2See more

mlflow-controller mlflow-deployment-controller 0.1.8

2 of the 2 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
gitpython@3.1.31
3.1.62
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
gitpython@3.1.31
3.1.62

Open the chart page →

10,161
mlflow-servermlflowserver0.1.91 of 3See more

mlflow-server mlflowserver 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
buntha/mlflow:2.1.1154542cc3083
gitpython@3.1.29
3.1.62

Open the chart page →

7,278
ovh-snapshoterovh-snapshoterOfficialVerified publisher0.4.101 of 1See more

ovh-snapshoter ovh-snapshoter 0.4.10

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
ghcr.io/hoverkraft-tech/ovh-snapshoter/app:0.4.1010d271f08ab3
gitpython@3.1.42
3.1.62

Open the chart page →

916
sceptresceptreai0.1.122 of 5See more

sceptre sceptreai 0.1.12

2 of the 5 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
maponyacharles/sceptreai:mlflow-0.1.1242d418654ebd
gitpython@3.1.57
3.1.62
maponyacharles/sceptreai:api-0.1.127b37b092130a
gitpython@3.1.57
3.1.62

Open the chart page →

5,636
streamlit-appstreamlit-appVerified publisher0.2.01 of 1See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
sruthitanneru/pi-sample:ui-lateste565ea454ffd
gitpython@3.1.43
3.1.62

Open the chart page →

1,927
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
gitpython@3.1.46
3.1.62

Open the chart page →

6,207
ambassadorazureorkestra6.7.91 of 2See more

ambassador azureorkestra 6.7.9

1 of the 2 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
datawire/aes:1.13.62beb65062c8b
gitpython@3.1.11
3.1.62

Open the chart page →

6,999
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
gitpython@3.1.44
3.1.62

Open the chart page →

18,071
cloudlaunchcloudve0.6.01 of 5See more

cloudlaunch cloudve 0.6.0

1 of the 5 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
gitpython@3.1.24
3.1.62

Open the chart page →

13,112
cloudlaunch-servercloudve0.2.01 of 5See more

cloudlaunch-server cloudve 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
gitpython@3.1.24
3.1.62

Open the chart page →

12,621
cloudlaunchservercloudve0.6.01 of 4See more

cloudlaunchserver cloudve 0.6.0

1 of the 4 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
gitpython@3.1.24
3.1.62

Open the chart page →

12,247
galaxykubemancloudve2.10.11 of 7See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
gitpython@3.1.27
3.1.62

Open the chart page →

20,007
csghubcsghubVerified publisher2.5.01 of 34See more

csghub csghub 2.5.0

1 of the 34 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6.5-241cba9c366f1
gitpython@3.1.43
3.1.62

Open the chart page →

62,708
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
gitpython@3.1.41
3.1.62

Open the chart page →

14,073
jupyterhubd4nVerified publisher3.3.71 of 7See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
gitpython@3.1.43
3.1.62

Open the chart page →

19,784
mlflowdeliveryheroVerified publisher1.0.101 of 1See more

mlflow deliveryhero 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
gitpython@3.1.7
3.1.62

Open the chart page →

5,074
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
gitpython@3.1.45
3.1.62

Open the chart page →

11,176
mlflowhelm-charts-nr1.0.101 of 1See more

mlflow helm-charts-nr 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
gitpython@3.1.7
3.1.62

Open the chart page →

5,074
weblatehelm-charts-nr0.3.21 of 3See more

weblate helm-charts-nr 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
gitpython@3.1.7
3.1.62

Open the chart page →

10,735
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
gitpython@3.1.44
3.1.62

Open the chart page →

3,891
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
gitpython@3.1.44
3.1.62

Open the chart page →

4,028
ilum-streamlitilumVerified publisher0.1.01 of 1See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
ilum/streamlit-example:1.0.0ce5dcdeb22ba
gitpython@3.1.45
3.1.62

Open the chart page →

3,186
erpnextimprowisedVerified publisher3.3.01 of 3See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
improwised/erpnext-worker:v13.4.197280b55cbd4
gitpython@3.1.17
3.1.62

Open the chart page →

8,098
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
gitpython@3.1.41
3.1.62

Open the chart page →

20,889
mlflowkelvins0.4.01 of 3See more

mlflow kelvins 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
kelvinsp/mlflow:1.26.1cd33e6db2a59
gitpython@3.1.27
3.1.62

Open the chart page →

5,194
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
gitpython@3.1.44
3.1.62

Open the chart page →

9,561
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
gitpython@3.1.29
3.1.62

Open the chart page →

2,979
legendlegend0.1.21 of 1See more

legend legend 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
ghcr.io/grofers/legend:0.1d6e901ad0ebd
gitpython@3.1.0
3.1.62

Open the chart page →

5,580
mlflow-servermlflow-server0.3.01 of 1See more

mlflow-server mlflow-server 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
gitpython@3.1.31
3.1.62

Open the chart page →

3,517
mlflowmondata-helm-chartsVerified publisher0.2.31 of 1See more

mlflow mondata-helm-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
gitpython@3.1.31
3.1.62

Open the chart page →

4,140
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
gitpython@3.1.31
3.1.62

Open the chart page →

6,399
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
gitpython@3.1.43
3.1.62

Open the chart page →

20,737
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
gitpython@3.1.50
3.1.62

Open the chart page →

8,200
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
gitpython@3.1.50
3.1.62

Open the chart page →

9,334
runwhen-localrunwhen-contribVerified publisher0.7.21 of 3See more

runwhen-local runwhen-contrib 0.7.2

1 of the 3 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
gitpython@3.1.50
3.1.62

Open the chart page →

4,196
otterwikischmitzis0.1.01 of 1See more

otterwiki schmitzis 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-100689.

Container imageDigestPackageFixed in
redimp/otterwiki:21435c8cc536d
gitpython@3.1.59
3.1.62

Open the chart page →

3,061

Container images carrying it

60 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
gitpython@3.1.44
3.1.62
1
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
gitpython@3.1.42
3.1.62
1
ghcr.io/grofers/legend:0.1d6e901ad0ebd
gitpython@3.1.0
3.1.62
1
ghcr.io/hoverkraft-tech/ovh-snapshoter/app:0.4.1010d271f08ab3
gitpython@3.1.42
3.1.62
1
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
gitpython@3.1.46
3.1.62
1
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
gitpython@3.1.31
3.1.62
1
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
gitpython@3.1.50
3.1.62
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.4914e75d9f445
gitpython@3.1.50
3.1.62
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
gitpython@3.1.43
3.1.62
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
gitpython@3.1.43
3.1.62
1

syft 1.42.1 · advisories as of 10 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.