diff --git a/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch b/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch
new file mode 100644
index 0000000000..a94711d690
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch
@@ -0,0 +1,90 @@
+From 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Tue, 1 Sep 2026 11:33:19 +0200
+Subject: [PATCH] Reject submodule checkout paths outside the repository
+
+GHSA-59cr-6r3x-644w identifies that submodule update paths could reach
+filesystem operations without the containment check already used by add and
+move.
+
+Add a regression that proves update rejects a parent-directory checkout
+path before cloning, and override Submodule.abspath to apply the shared
+_to_relative_path guard for every filesystem consumer.
+
+Git baseline: git.git read-cache.c verify_path_internal() rejects invalid index
+paths, covered for parent traversal by t/t9300-fast-import.sh.
+
+CVE: CVE-2026-100689
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093]
+
+Backport Changes:
+- Strengthened the 3.1.43 _to_relative_path implementation to normalize
+  paths and verify commonpath containment; its prior prefix check did not
+  reject relative parent-directory traversal.
+- Omitted doc/source/changes.rst because it only records the release note.
+- Omitted test/test_submodule.py because the PyPI source archive does not
+  include the test suite.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/objects/submodule/base.py | 46 +++++++++++++++++++++++++++++------------
+ 1 file changed, 33 insertions(+), 13 deletions(-)
+
+--- a/git/objects/submodule/base.py
++++ b/git/objects/submodule/base.py
+@@ -400,19 +400,39 @@
+             path = path[:-1]
+         # END handle trailing slash
+ 
+-        if osp.isabs(path) and parent_repo.working_tree_dir:
+-            working_tree_linux = to_native_path_linux(parent_repo.working_tree_dir)
+-            if not path.startswith(working_tree_linux):
+-                raise ValueError(
+-                    "Submodule checkout path '%s' needs to be within the parents repository at '%s'"
+-                    % (working_tree_linux, path)
+-                )
+-            path = path[len(working_tree_linux.rstrip("/")) + 1 :]
+-            if not path:
+-                raise ValueError("Absolute submodule path '%s' didn't yield a valid relative path" % path)
+-            # END verify converted relative path makes sense
+-        # END convert to a relative path
+-
++        root = parent_repo.working_tree_dir
++        if root:
++            drive, tail = osp.splitdrive(path)
++            separators = (os.sep,) if os.altsep is None else (os.sep, os.altsep)
++            if drive and not tail.startswith(separators):
++                raise ValueError("Drive-relative path %r is not supported" % path)
++
++            root_abs = osp.abspath(to_native_path_linux(root))
++            path_abs = osp.abspath(osp.join(root_abs, path))
++            try:
++                common_path = osp.commonpath([root_abs, path_abs])
++            except ValueError as e:
++                raise ValueError("Submodule checkout path %r is not in repository at %r" % (path, root_abs)) from e
++            if osp.normcase(common_path) != osp.normcase(root_abs):
++                raise ValueError("Submodule checkout path %r is not in repository at %r" % (path, root_abs))
++
++            path = to_native_path_linux(osp.relpath(path_abs, root_abs))
++
++        if not path or path == ".":
++            raise ValueError("Submodule checkout path must not be the repository root")
++
++        return path
++
++    @property
++    def abspath(self) -> PathLike:
++        root = self.repo.working_tree_dir
++        if root is None:
++            return super().abspath
++        path = root
++        for component in self._to_relative_path(self.repo, self.path).split("/"):
++            path = join_path_native(path, component)
++            if osp.islink(path):
++                raise ValueError("Submodule checkout path %r contains a symbolic link" % self.path)
+         return path
+ 
+     @classmethod
diff --git a/meta/recipes-devtools/python/python3-git_3.1.43.bb b/meta/recipes-devtools/python/python3-git_3.1.43.bb
index 13bcc5bbdc..79baf0aacc 100644
--- a/meta/recipes-devtools/python/python3-git_3.1.43.bb
+++ b/meta/recipes-devtools/python/python3-git_3.1.43.bb
@@ -51,6 +51,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
            file://CVE-2026-87818.patch \
            file://CVE-2026-87819_p1.patch \
            file://CVE-2026-87819_p2.patch \
+           file://CVE-2026-100689.patch \
            "
 SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"