CVE-2026-53584
- Source
- https://cve.org/CVERecord?id=CVE-2026-53584
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53584.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-53584
- Aliases
-
- GHSA-cw77-j82w-mchm
- Downstream
- Related
- Published
- 2026-08-20T18:35:10.280Z
- Modified
- 2026-08-22T10:47:46.047171Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- libgit2: Submodule path traversal
- Details
-
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include gitsubmodulelookup and gitsubmoduleadd_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.
- Database specific
{ "cwe_ids": [ "CWE-22" ], "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53584.json" }- References
-
- https://github.com/libgit2/libgit2/releases/tag/v1.8.6
- https://github.com/libgit2/libgit2/releases/tag/v1.9.5
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53584.json
- https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm
- https://nvd.nist.gov/vuln/detail/CVE-2026-53584
- https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1
- https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c
- https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4
Affected packages
Git / github.com/libgit2/libgit2
Affected ranges
- Type
- GIT
- Repo
- https://github.com/libgit2/libgit2
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedIntroducedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "source": [ "AFFECTED_FIELD", "REFERENCES" ], "extracted_events": [ { "introduced": "0" }, { "fixed": "1.8.6" }, { "introduced": "1.9.0" }, { "fixed": "1.9.5" } ] }
Affected versions
v0.*
v0.1.0
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.2.0
v0.21.0
v0.22.0
v0.22.0-rc1
v0.22.0-rc2
v0.23.0
v0.23.0-rc1
v0.23.0-rc2
v0.24.0
v0.24.0-rc1
v0.26.0
v0.26.0-rc1
v0.26.0-rc2
v0.27.0
v0.27.0-rc1
v0.27.0-rc2
v0.27.0-rc3
v0.28.0
v0.28.0-rc1
v0.3.0
v0.8.0
v0.99.0
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.1
v1.6.2
v1.6.3
v1.7.0
v1.8.0
v1.8.1
v1.8.3
v1.8.4
v1.8.5
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53584.json"
vanir_signatures
[
{
"digest": {
"function_hash": "23968005263352477406873290810917042956",
"length": 1291.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-01528df5",
"source": "https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c",
"target": {
"file": "src/libgit2/submodule.c",
"function": "load_submodule_names"
},
"deprecated": false
},
{
"digest": {
"function_hash": "190390390455802812816328615008147320336",
"length": 185.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-246d05c0",
"source": "https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1",
"target": {
"file": "src/libgit2/submodule.c",
"function": "submodule_config_error"
},
"deprecated": false
},
{
"digest": {
"function_hash": "36743701857299552912745355159670741707",
"length": 1953.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-3ecc34fe",
"source": "https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4",
"target": {
"file": "src/libgit2/submodule.c",
"function": "git_submodule__lookup_with_cache"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"284778548496131570997298999589520680963",
"50409244139806353498618115036657202339",
"311649424898367354028624312245316306454",
"12162111922096392161473525694721387469",
"290093881164824076923832539705728861867",
"85514486298652536011922390149393799265",
"117891897382636596493862313342892980798",
"60836859922387901046952995635630269495",
"252601166622773062336129181329677699656",
"243354088888844028485665473473219188835",
"28989487736955564145749965472504708069",
"89293308424436554149442397631321397899",
"327513995677359554093243007554912202631",
"133338068183833451063445911250038825372",
"182641116660834033679459988615538470972"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-44f969c8",
"source": "https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c",
"target": {
"file": "src/util/fs_path.h"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"140035700741311767051885081073103264504",
"102117213921216368445604755350063896486",
"87948301654375165942292901656849920711",
"202351080633657998579795430882332228953",
"80214970668541121393338827979181184114",
"168258605566392051192147152590555976691",
"111689921546577051560234540346387411956",
"193294455462261803896327101985839289518",
"230426462822728894942190195008853465979",
"221668221308977214734606759650235976459",
"270769537304049769107042588487393264756",
"162335679138367972121981542258278627912",
"116928575150052784033989929497074948463",
"209446022871047761573149856713314768941",
"35425203668887444935835955537369762178",
"247248378869790723362566718934686890172",
"336982741478482396907435436575208771120",
"78373631371826682376087984823327211168",
"251835234432271469859209859352395927169",
"141847062327034727896777589174246993672",
"317709028622248452038516294109135080523",
"178900971066171720898435763483627742705",
"20848137041148109409562516475786099319",
"269071949861996204582924598950710671377",
"208127670350810447485348960392947413884",
"179183749042983288980569257975022463831",
"309180862489004386734621066945817748629",
"258643581723643426900341708256308625983",
"230310183961395868442431071231362422798",
"164646445643169656225114781135517788875",
"202407620012173417943360537489053932801",
"5699347164658408327827915191286856950",
"267819104903165717970991980314874679582",
"74008888161006388016900894950509892050",
"252935444753998230158003991065188913110",
"297806270014983159528189507893572967067",
"179251424947887059348710996722269889488",
"244313634146070875358124907963787595136",
"233908064599028728463806744662612342954",
"60800529225092524856606663993270359434",
"185601893217247891376042144506862658272",
"276667241711327762224871947619248757960",
"284416855458008002974779057720835506073",
"100582887106957472016422840405270568927",
"183477733008757943116090659879158490913",
"245561939553214348096058573277712902168",
"154904392244993210108491970234014216229",
"222127278985076867815117872017476699836",
"71060886767088270084633731683805867337",
"156707773832850315328991759914538200343",
"53936484389657115173696714550136630357",
"34573346206629575750228784440238510838",
"156986101489405824379133506191615827310",
"139156068970095178566288585721966476481",
"229502280212259279289324089936053535158",
"130593814639610026290203845548300727878",
"68381738871275332013882370374092642913",
"139676496146094757431136425205617369793"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-45583c71",
"source": "https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c",
"target": {
"file": "src/libgit2/submodule.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "190390390455802812816328615008147320336",
"length": 185.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-498df9a9",
"source": "https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4",
"target": {
"file": "src/libgit2/submodule.c",
"function": "submodule_config_error"
},
"deprecated": false
},
{
"digest": {
"function_hash": "30406406931780910979215481225003964315",
"length": 258.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-4b9b42ef",
"source": "https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c",
"target": {
"file": "tests/libgit2/submodule/escape.c",
"function": "find_evil"
},
"deprecated": false
},
{
"digest": {
"function_hash": "226530648389372440579200610964070529722",
"length": 1190.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-5302082f",
"source": "https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1",
"target": {
"file": "src/libgit2/submodule.c",
"function": "load_submodule_names"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"20081590161418030603447731683887565616",
"273855338202138193768343391952584416925",
"204996700117750643282175216839069959388",
"340059142987946805301114555782757068716"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-5514650d",
"source": "https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4",
"target": {
"file": "tests/libgit2/submodule/submodule_helpers.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "302563450897946914633202836142169010705",
"length": 697.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-5a45e215",
"source": "https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1",
"target": {
"file": "src/libgit2/submodule.c",
"function": "git_submodule_reload"
},
"deprecated": false
},
{
"digest": {
"function_hash": "302563450897946914633202836142169010705",
"length": 697.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-5f019bc6",
"source": "https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4",
"target": {
"file": "src/libgit2/submodule.c",
"function": "git_submodule_reload"
},
"deprecated": false
},
{
"digest": {
"function_hash": "36743701857299552912745355159670741707",
"length": 1953.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-60290355",
"source": "https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c",
"target": {
"file": "src/libgit2/submodule.c",
"function": "git_submodule__lookup_with_cache"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"84495065203722201020605002512175302131",
"98182486721848648484166429299400755388",
"229776523202010966620247121369408994626",
"268645008109449580438524566232104949730",
"252264274423518509169801285866902397380",
"329200362052666377701241940011771307169",
"302640951132319063435189498672136648252",
"301638543598882664286769829299726270526",
"117439246456667582861591425435757061597",
"193010157430748507126515746172970395289",
"246456065187611841541997412083998140937",
"139483793730865887817583680309552708731",
"301638543598882664286769829299726270526",
"264232233949598148707091147729562676370",
"192220434702504635068809092737288830743",
"181565214739106406165666222364615497144",
"176819852181113633403275213063315675825",
"253945887157242527810035643065117553829"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-61699874",
"source": "https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1",
"target": {
"file": "tests/libgit2/submodule/escape.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"20081590161418030603447731683887565616",
"273855338202138193768343391952584416925",
"204996700117750643282175216839069959388",
"340059142987946805301114555782757068716"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-71ae4b2e",
"source": "https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c",
"target": {
"file": "tests/libgit2/submodule/submodule_helpers.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"84495065203722201020605002512175302131",
"98182486721848648484166429299400755388",
"229776523202010966620247121369408994626",
"268645008109449580438524566232104949730",
"252264274423518509169801285866902397380",
"329200362052666377701241940011771307169",
"302640951132319063435189498672136648252",
"117439246456667582861591425435757061597",
"193010157430748507126515746172970395289",
"246456065187611841541997412083998140937",
"139483793730865887817583680309552708731",
"264232233949598148707091147729562676370",
"192220434702504635068809092737288830743",
"181565214739106406165666222364615497144",
"176819852181113633403275213063315675825",
"253945887157242527810035643065117553829"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-751d709a",
"source": "https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c",
"target": {
"file": "tests/libgit2/submodule/escape.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"84495065203722201020605002512175302131",
"98182486721848648484166429299400755388",
"229776523202010966620247121369408994626",
"268645008109449580438524566232104949730",
"252264274423518509169801285866902397380",
"329200362052666377701241940011771307169",
"302640951132319063435189498672136648252",
"301638543598882664286769829299726270526",
"117439246456667582861591425435757061597",
"193010157430748507126515746172970395289",
"246456065187611841541997412083998140937",
"139483793730865887817583680309552708731",
"301638543598882664286769829299726270526",
"264232233949598148707091147729562676370",
"192220434702504635068809092737288830743",
"181565214739106406165666222364615497144",
"176819852181113633403275213063315675825",
"253945887157242527810035643065117553829"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-7ffb69af",
"source": "https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4",
"target": {
"file": "tests/libgit2/submodule/escape.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "30406406931780910979215481225003964315",
"length": 258.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-80d889fe",
"source": "https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1",
"target": {
"file": "tests/libgit2/submodule/escape.c",
"function": "find_evil"
},
"deprecated": false
},
{
"digest": {
"function_hash": "23968005263352477406873290810917042956",
"length": 1291.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-8932b412",
"source": "https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4",
"target": {
"file": "src/libgit2/submodule.c",
"function": "load_submodule_names"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"20081590161418030603447731683887565616",
"273855338202138193768343391952584416925",
"204996700117750643282175216839069959388",
"340059142987946805301114555782757068716"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-8cedc28d",
"source": "https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1",
"target": {
"file": "tests/libgit2/submodule/submodule_helpers.c"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"140035700741311767051885081073103264504",
"102117213921216368445604755350063896486",
"87948301654375165942292901656849920711",
"202351080633657998579795430882332228953",
"80214970668541121393338827979181184114",
"168258605566392051192147152590555976691",
"111689921546577051560234540346387411956",
"193294455462261803896327101985839289518",
"230426462822728894942190195008853465979",
"221668221308977214734606759650235976459",
"270769537304049769107042588487393264756",
"162335679138367972121981542258278627912",
"116928575150052784033989929497074948463",
"209446022871047761573149856713314768941",
"35425203668887444935835955537369762178",
"247248378869790723362566718934686890172",
"336982741478482396907435436575208771120",
"78373631371826682376087984823327211168",
"251835234432271469859209859352395927169",
"141847062327034727896777589174246993672",
"317709028622248452038516294109135080523",
"178900971066171720898435763483627742705",
"20848137041148109409562516475786099319",
"269071949861996204582924598950710671377",
"208127670350810447485348960392947413884",
"170531564164866745607760592890155872806",
"179183749042983288980569257975022463831",
"309180862489004386734621066945817748629",
"258643581723643426900341708256308625983",
"164646445643169656225114781135517788875",
"202407620012173417943360537489053932801",
"5699347164658408327827915191286856950",
"267819104903165717970991980314874679582",
"74008888161006388016900894950509892050",
"252935444753998230158003991065188913110",
"297806270014983159528189507893572967067",
"179251424947887059348710996722269889488",
"244313634146070875358124907963787595136",
"233908064599028728463806744662612342954",
"60800529225092524856606663993270359434",
"185601893217247891376042144506862658272",
"276667241711327762224871947619248757960",
"284416855458008002974779057720835506073",
"100582887106957472016422840405270568927",
"183477733008757943116090659879158490913",
"245561939553214348096058573277712902168",
"154904392244993210108491970234014216229",
"222127278985076867815117872017476699836",
"71060886767088270084633731683805867337",
"156707773832850315328991759914538200343",
"53936484389657115173696714550136630357",
"34573346206629575750228784440238510838",
"156986101489405824379133506191615827310",
"139156068970095178566288585721966476481",
"229502280212259279289324089936053535158",
"130593814639610026290203845548300727878",
"68381738871275332013882370374092642913",
"139676496146094757431136425205617369793"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-96e2fcbc",
"source": "https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4",
"target": {
"file": "src/libgit2/submodule.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "107788351409428065508247257668115007684",
"length": 911.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-9ccea2a0",
"source": "https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4",
"target": {
"file": "src/libgit2/submodule.c",
"function": "submodule_load_each"
},
"deprecated": false
},
{
"digest": {
"function_hash": "302563450897946914633202836142169010705",
"length": 697.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-b6f6357a",
"source": "https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c",
"target": {
"file": "src/libgit2/submodule.c",
"function": "git_submodule_reload"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"284778548496131570997298999589520680963",
"50409244139806353498618115036657202339",
"311649424898367354028624312245316306454",
"12162111922096392161473525694721387469",
"290093881164824076923832539705728861867",
"85514486298652536011922390149393799265",
"117891897382636596493862313342892980798",
"60836859922387901046952995635630269495",
"252601166622773062336129181329677699656",
"243354088888844028485665473473219188835",
"28989487736955564145749965472504708069",
"89293308424436554149442397631321397899",
"327513995677359554093243007554912202631",
"133338068183833451063445911250038825372",
"182641116660834033679459988615538470972"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-bc3a5d48",
"source": "https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4",
"target": {
"file": "src/util/fs_path.h"
},
"deprecated": false
},
{
"digest": {
"function_hash": "107788351409428065508247257668115007684",
"length": 911.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-c07f606b",
"source": "https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c",
"target": {
"file": "src/libgit2/submodule.c",
"function": "submodule_load_each"
},
"deprecated": false
},
{
"digest": {
"function_hash": "107788351409428065508247257668115007684",
"length": 911.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-cb6e5fe6",
"source": "https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1",
"target": {
"file": "src/libgit2/submodule.c",
"function": "submodule_load_each"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"140035700741311767051885081073103264504",
"102117213921216368445604755350063896486",
"87948301654375165942292901656849920711",
"202351080633657998579795430882332228953",
"80214970668541121393338827979181184114",
"168258605566392051192147152590555976691",
"111689921546577051560234540346387411956",
"99924476102097051143254777774616399598",
"230426462822728894942190195008853465979",
"221668221308977214734606759650235976459",
"270769537304049769107042588487393264756",
"162335679138367972121981542258278627912",
"236344132510429050528477209770085760404",
"333199108549537307740096803426842745430",
"32400494981141262267887101639417577497",
"261717283219953550718693996501655921375",
"197014922733066906257393958340291725459",
"78373631371826682376087984823327211168",
"251835234432271469859209859352395927169",
"141847062327034727896777589174246993672",
"317709028622248452038516294109135080523",
"178900971066171720898435763483627742705",
"20848137041148109409562516475786099319",
"269071949861996204582924598950710671377",
"208127670350810447485348960392947413884",
"170531564164866745607760592890155872806",
"179183749042983288980569257975022463831",
"309180862489004386734621066945817748629",
"258643581723643426900341708256308625983",
"164646445643169656225114781135517788875",
"202407620012173417943360537489053932801",
"5699347164658408327827915191286856950",
"51895877851870391697100521381631749548",
"210666915012419904340070829741769978513",
"138112394292239533705043874363060249063",
"193365868757727283536718522147597167468",
"68793182504483980507695785455267909526",
"267819104903165717970991980314874679582",
"74008888161006388016900894950509892050",
"252935444753998230158003991065188913110",
"297806270014983159528189507893572967067",
"179251424947887059348710996722269889488",
"244313634146070875358124907963787595136",
"233908064599028728463806744662612342954",
"60800529225092524856606663993270359434",
"185601893217247891376042144506862658272",
"276667241711327762224871947619248757960",
"284416855458008002974779057720835506073",
"100582887106957472016422840405270568927",
"183477733008757943116090659879158490913",
"245561939553214348096058573277712902168",
"154904392244993210108491970234014216229",
"222127278985076867815117872017476699836",
"71060886767088270084633731683805867337",
"156707773832850315328991759914538200343",
"53936484389657115173696714550136630357",
"34573346206629575750228784440238510838",
"156986101489405824379133506191615827310",
"139156068970095178566288585721966476481",
"229502280212259279289324089936053535158",
"8344297288046437561183424980271274048",
"209241843338705951968877877850799517424",
"182461093454132082554015247841150396744"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-cc8f8673",
"source": "https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1",
"target": {
"file": "src/libgit2/submodule.c"
},
"deprecated": false
},
{
"digest": {
"function_hash": "30406406931780910979215481225003964315",
"length": 258.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-d362bc1e",
"source": "https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4",
"target": {
"file": "tests/libgit2/submodule/escape.c",
"function": "find_evil"
},
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"284778548496131570997298999589520680963",
"50409244139806353498618115036657202339",
"311649424898367354028624312245316306454",
"12162111922096392161473525694721387469",
"290093881164824076923832539705728861867",
"85514486298652536011922390149393799265",
"117891897382636596493862313342892980798",
"60836859922387901046952995635630269495",
"252601166622773062336129181329677699656",
"243354088888844028485665473473219188835",
"28989487736955564145749965472504708069",
"89293308424436554149442397631321397899",
"327513995677359554093243007554912202631",
"133338068183833451063445911250038825372",
"182641116660834033679459988615538470972"
]
},
"signature_type": "Line",
"signature_version": "v1",
"id": "CVE-2026-53584-d464305c",
"source": "https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1",
"target": {
"file": "src/util/fs_path.h"
},
"deprecated": false
},
{
"digest": {
"function_hash": "146180070227448308400444078540661416671",
"length": 1958.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-d4803a28",
"source": "https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1",
"target": {
"file": "src/libgit2/submodule.c",
"function": "git_submodule__lookup_with_cache"
},
"deprecated": false
},
{
"digest": {
"function_hash": "190390390455802812816328615008147320336",
"length": 185.0
},
"signature_type": "Function",
"signature_version": "v1",
"id": "CVE-2026-53584-fbb69c17",
"source": "https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c",
"target": {
"file": "src/libgit2/submodule.c",
"function": "submodule_config_error"
},
"deprecated": false
}
]
vanir_signatures_modified
"2026-08-22T10:47:46Z"