new file mode 100644
@@ -0,0 +1,60 @@
+From 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Subject: [PATCH] Reject submodule checkout paths outside the repository
+
+The submodule path from .gitmodules reaches filesystem operations during
+update without the containment validation used by other operations.
+Validate the checkout path and reject symbolic links before returning its
+absolute path.
+
+CVE: CVE-2026-100689
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093]
+
+Backport Changes:
+- GitPython 3.1.42's _to_relative_path() does not reject relative parent
+ traversal or the repository root. Add canonical containment validation
+ in abspath before its upstream component and symlink checks.
+- Omit upstream regression tests because the PyPI source archive does not
+ contain the test suite. Omit the documentation-only release note.
+
+(cherry picked from commit 1ed0ebc2f2e74d979cdc367a4864a7731fdcc093)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/objects/submodule/base.py | 24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+diff --git a/git/objects/submodule/base.py b/git/objects/submodule/base.py
+index 84d6bcdc..d6d317ab 100644
+--- a/git/objects/submodule/base.py
++++ b/git/objects/submodule/base.py
+@@ -354,4 +354,28 @@ class Submodule(IndexObject, TraversableIterableObj):
+ return path
+
++ @property
++ def abspath(self) -> PathLike:
++ root = self.repo.working_tree_dir
++ if root is None:
++ return super().abspath
++
++ root = osp.realpath(root)
++ checkout_path = osp.realpath(osp.join(root, os.fspath(self.path)))
++ try:
++ common_path = osp.commonpath([root, checkout_path])
++ except ValueError as e:
++ raise ValueError("Submodule checkout path %r is not in repository" % self.path) from e
++ if osp.normcase(common_path) != osp.normcase(root):
++ raise ValueError("Submodule checkout path %r is not in repository" % self.path)
++ if osp.normcase(checkout_path) == osp.normcase(root):
++ raise ValueError("Submodule checkout path must not be the repository root")
++
++ path = root
++ for component in os.fspath(self._to_relative_path(self.repo, self.path)).split("/"):
++ path = join_path_native(path, component)
++ if osp.islink(path):
++ raise ValueError("Submodule checkout path %r contains a symbolic link" % self.path)
++ return path
++
+ @classmethod
+ def _write_git_file_and_module_config(cls, working_tree_dir: PathLike, module_abspath: PathLike) -> None:
+--
+2.35.6
@@ -51,6 +51,7 @@ SRC_URI += " file://CVE-2026-42284.patch \
file://CVE-2026-87818.patch \
file://CVE-2026-87819_p1.patch \
file://CVE-2026-87819_p2.patch \
+ file://CVE-2026-100689.patch \
"
SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093 [2] https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python/python3-git/CVE-2026-100689.patch | 60 +++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-100689.patch