Loading vulnerability…
Submodule Path Traversal in libgit2
CVE-2026-53584 is a relative path traversal vulnerability in libgit2's handling of repository submodule configuration. Affected versions fail to reject parent-directory traversal components in submodule paths, including in the git_submodule_lookup and git_submodule_add_setup code paths. Processing a crafted repository can cause submodule operations to escape the repository working tree and create directories outside it. The vulnerability is fixed in libgit2 1.8.6 and 1.9.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker-controlled repository can cause filesystem modifications outside the intended working tree when an application processes malicious submodule paths. Confirmed behavior includes out-of-tree directory creation; affected operations may also permit out-of-tree file writes. The impact is limited by the filesystem permissions of the application process. Arbitrary code execution, credential disclosure, and denial of service are not established consequences of this vulnerability.
If you can’t patch tonight, do this now.
Until patched, avoid initializing or updating submodules from untrusted repositories. Restrict the application's filesystem write permissions outside the intended working tree to reduce the scope of possible out-of-tree modifications. These measures reduce exposure but do not correct the path-validation flaw.
Patch, then assume compromise.
Upgrade to libgit2 1.8.6 or later in the 1.8 release line, or 1.9.5 or later in the 1.9 release line. Distribution backports include Debian 12 package version 1.5.1+ds-1+deb12u2 and Debian 13 package version 1.9.0+ds-2+deb13u1. Update applications that statically bundle libgit2 as well as the system library; affected Rust application rebuilds using libgit2-sys replace the vulnerable bundled library with the patched system library.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.