GitPython versions 3.1.62 through 3.1.x before 3.2.0 contain a flaw in Submodule.move() that checks only the lexical destination and does not reject symbolic links in intermediate components. An untrusted repository can embed a symlink, such as one named vendor, that points outside the worktree. When an application calls Submodule.move(), the library follows that symlink, relocating the checked‑out submodule to the external location and corrupting the repository index and .gitmodules file. This flaw can allow an attacker who controls a commit to write arbitrary content outside the repository, potentially compromising configured infrastructure or application state.

The vulnerability affects the GitPython project as maintained by the gitpython‑developers. Any deployment of GitPython 3.1.62, 3.1.63, 3.1.64, 3.1.65, 3.1.66, 3.1.67, 3.1.68, 3.1.69, 3.1.70, 3.1.71, 3.1.72, 3.1.73, 3.1.74, 3.1.75, 3.1.76, 3.1.77, 3.1.78, 3.1.79, 3.1.80, 3.1.81, 3.1.82, 3.1.83, 3.1.84, 3.1.85, 3.1.86, 3.1.87, 3.1.88 or 3.1.89 is vulnerable. The fix is included in GitPython 3.2.0 and later.

The CVSS base score of 6.9 indicates moderate severity. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an application that uses Submodule.move() and an untrusted repository that contains a malicious symlink. If an attacker can supply such a repository, they can cause the library to write files outside the intended worktree, corrupting repository configuration and potentially affecting any services that depend on the repository. The impact is confined to the local environment of the application, so privilege escalation or remote code execution is not inherent but may occur if the application runs with elevated privileges or if malicious files are placed in locations that satisfy other vulnerabilities.