CVE-2026-100689
MediumAdvisory
Published 30 Sept 2026In the index since 1 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.1
- base score, highest
- EPSS
- 0.004
- 32nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 53
- of 18,087 indexed, latest versions
- Container images
- 60
- deployed by those charts
- Fix available
- 1 of 1
- affected package
GitPython submodule update path traversal can write outside the repository
Carried by container images the latest versions of 53 of 18,087 indexed charts deploy, on 60 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| gitpythonpypi | 3.1.0, 3.1.7, 3.1.11, 3.1.17+18 more | 3.1.62 | 60 |
- OSV records
- GHSA-59cr-6r3x-644w
Charts affected
53 by stars
Container images carrying it
60 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| cloudve/ | 4a3d7fae90bb | gitpython | 3.1.62 | 3 |
| datawire/ | 8588eafe6862 | gitpython | 3.1.62 | 3 |
| larribas/ | 05ccb0b46bfb | gitpython | 3.1.62 | 2 |
| weblate/ | 69c160d37a3c | gitpython | 3.1.62 | 2 |
| apecloud/ | 8ac9947a2c84 | gitpython | 3.1.62 | 1 |
| aristidetm/ | 469dbc951224 | gitpython | 3.1.62 | 1 |
| berkeleyskypilot/ | 8da2f3cda472 | gitpython | 3.1.62 | 1 |
| buntha/ | 154542cc3083 | gitpython | 3.1.62 | 1 |
| burakince/ | ab4b566644b9 | gitpython | 3.1.62 | 1 |
| checkmk/ | c11b422210c4 | gitpython | 3.1.62 | 1 |
| datawire/ | 07f8fe4f4f8e | gitpython | 3.1.62 | 1 |
| datawire/ | 2beb65062c8b | gitpython | 3.1.62 | 1 |
| datawire/ | 9716efbdd24b | gitpython | 3.1.62 | 1 |
| evk02/ | ef6ff257ef35 | gitpython | 3.1.62 | 1 |
| galaxy/ | e5c265fe9fcd | gitpython | 3.1.62 | 1 |
| helmforge/ | 61f759a1421f | gitpython | 3.1.62 | 1 |
| helmforge/ | fcb7017327d6 | gitpython | 3.1.62 | 1 |
| ilum/ | ce5dcdeb22ba | gitpython | 3.1.62 | 1 |
| improwised/ | 97280b55cbd4 | gitpython | 3.1.62 | 1 |
| intelowlproject/ | 0b22e547ea6b | gitpython | 3.1.62 | 1 |
| kelvinsp/ | cd33e6db2a59 | gitpython | 3.1.62 | 1 |
| kyso/ | 4aa9d38ee81d | gitpython | 3.1.62 | 1 |
| langgenius/ | dcefa5f7c47c | gitpython | 3.1.62 | 1 |
| maponyacharles/ | 42d418654ebd | gitpython | 3.1.62 | 1 |
| maponyacharles/ | 7b37b092130a | gitpython | 3.1.62 | 1 |
| mondata/ | 6f94c6caf8bf | gitpython | 3.1.62 | 1 |
| networktocode/ | ed484336b1ad | gitpython | 3.1.62 | 1 |
| opencsghq/ | 41cba9c366f1 | gitpython | 3.1.62 | 1 |
| opencsghq/ | c36a5bac3cf0 | gitpython | 3.1.62 | 1 |
| pangeo/ | 5fbe688a4f80 | gitpython | 3.1.62 | 1 |
| redimp/ | 1435c8cc536d | gitpython | 3.1.62 | 1 |
| robmarkcole/ | 410275726459 | gitpython | 3.1.62 | 1 |
| sirrend/ | 699e79e3d4e2 | gitpython | 3.1.62 | 1 |
| sirrend/ | 7ca688c7abf5 | gitpython | 3.1.62 | 1 |
| sruthitanneru/ | e565ea454ffd | gitpython | 3.1.62 | 1 |
| stackstorm/ | 88235ba70cad | gitpython | 3.1.62 | 1 |
| stackstorm/ | 6f56d239d280 | gitpython | 3.1.62 | 1 |
| stackstorm/ | 33ecfda16608 | gitpython | 3.1.62 | 1 |
| stackstorm/ | 4e3f8c7ca52d | gitpython | 3.1.62 | 1 |
| stackstorm/ | f190a6212195 | gitpython | 3.1.62 | 1 |
| stackstorm/ | 259503496ff9 | gitpython | 3.1.62 | 1 |
| stackstorm/ | b1de2055c362 | gitpython | 3.1.62 | 1 |
| stackstorm/ | b1a338f64773 | gitpython | 3.1.62 | 1 |
| stackstorm/ | 1c8904a3bf67 | gitpython | 3.1.62 | 1 |
| stackstorm/ | 1bf35bfaf00c | gitpython | 3.1.62 | 1 |
| stackstorm/ | 19fdfffdbba8 | gitpython | 3.1.62 | 1 |
| tachyongroup/ | 7e79b9000856 | gitpython | 3.1.62 | 1 |
| tachyongroup/ | f4f7fabe1037 | gitpython | 3.1.62 | 1 |
| weblate/ | 82848df56ecd | gitpython | 3.1.62 | 1 |
| gcr.io/ | 25d6975951f1 | gitpython | 3.1.62 | 1 |