{"id":"CVE-2026-53584","summary":"libgit2: Submodule path traversal","details":"libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule path loaded from .gitmodules. The affected src/libgit2/submodule.c paths include git_submodule_lookup and git_submodule_add_setup. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree. This issue is fixed in versions 1.8.6 and 1.9.5.","aliases":["GHSA-cw77-j82w-mchm"],"modified":"2026-08-22T10:47:46.047171Z","published":"2026-08-20T18:35:10.280Z","related":["openSUSE-SU-2026:11315-1"],"database_specific":{"cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53584.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/libgit2/libgit2/releases/tag/v1.8.6"},{"type":"WEB","url":"https://github.com/libgit2/libgit2/releases/tag/v1.9.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53584.json"},{"type":"ADVISORY","url":"https://github.com/libgit2/libgit2/security/advisories/GHSA-cw77-j82w-mchm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53584"},{"type":"FIX","url":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1"},{"type":"FIX","url":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c"},{"type":"FIX","url":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libgit2/libgit2","events":[{"introduced":"0"},{"introduced":"338e6fb681369ff0537719095e22ce9dc602dbf0"},{"fixed":"5853918c4c6a7b12f8becf4bd11ff4362ebb9020"},{"fixed":"f7a4071c766ceea3915415e22134cbe3e581c420"},{"fixed":"419637d3587396f5d139d6d88480eab3cd81e7a1"},{"fixed":"467c2d95ed663df722f83a5960edf568514b128c"},{"fixed":"ec7371da9f359cd8293e9108e7a0b1c1b61b67c4"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.8.6"},{"introduced":"1.9.0"},{"fixed":"1.9.5"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.8.5","v1.9.4","v1.9.3","v1.9.2","v1.9.1","v1.8.4","v1.9.0","v1.8.3","v1.8.1","v1.8.0","v1.7.0","v1.6.3","v1.6.2","v1.6.1","v1.5.0","v1.3.0","v1.4.0","v1.2.0","v1.1.0","v1.0.0","v0.99.0","v0.28.0-rc1","v0.28.0","v0.27.0","v0.27.0-rc3","v0.26.0-rc2","v0.26.0","v0.27.0-rc1","v0.27.0-rc2","v0.26.0-rc1","v0.24.0","v0.24.0-rc1","v0.23.0","v0.23.0-rc2","v0.23.0-rc1","v0.22.0","v0.22.0-rc2","v0.22.0-rc1","v0.21.0","v0.18.0","v0.17.0","v0.16.0","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0","v0.8.0","v0.3.0","v0.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-53584.json","vanir_signatures_modified":"2026-08-22T10:47:46Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","target":{"file":"src/libgit2/submodule.c","function":"load_submodule_names"},"deprecated":false,"digest":{"function_hash":"23968005263352477406873290810917042956","length":1291},"id":"CVE-2026-53584-01528df5"},{"deprecated":false,"digest":{"function_hash":"190390390455802812816328615008147320336","length":185},"id":"CVE-2026-53584-246d05c0","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1","target":{"file":"src/libgit2/submodule.c","function":"submodule_config_error"}},{"id":"CVE-2026-53584-3ecc34fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","target":{"file":"src/libgit2/submodule.c","function":"git_submodule__lookup_with_cache"},"deprecated":false,"digest":{"function_hash":"36743701857299552912745355159670741707","length":1953}},{"signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","target":{"file":"src/util/fs_path.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["284778548496131570997298999589520680963","50409244139806353498618115036657202339","311649424898367354028624312245316306454","12162111922096392161473525694721387469","290093881164824076923832539705728861867","85514486298652536011922390149393799265","117891897382636596493862313342892980798","60836859922387901046952995635630269495","252601166622773062336129181329677699656","243354088888844028485665473473219188835","28989487736955564145749965472504708069","89293308424436554149442397631321397899","327513995677359554093243007554912202631","133338068183833451063445911250038825372","182641116660834033679459988615538470972"]},"id":"CVE-2026-53584-44f969c8","signature_type":"Line"},{"digest":{"line_hashes":["140035700741311767051885081073103264504","102117213921216368445604755350063896486","87948301654375165942292901656849920711","202351080633657998579795430882332228953","80214970668541121393338827979181184114","168258605566392051192147152590555976691","111689921546577051560234540346387411956","193294455462261803896327101985839289518","230426462822728894942190195008853465979","221668221308977214734606759650235976459","270769537304049769107042588487393264756","162335679138367972121981542258278627912","116928575150052784033989929497074948463","209446022871047761573149856713314768941","35425203668887444935835955537369762178","247248378869790723362566718934686890172","336982741478482396907435436575208771120","78373631371826682376087984823327211168","251835234432271469859209859352395927169","141847062327034727896777589174246993672","317709028622248452038516294109135080523","178900971066171720898435763483627742705","20848137041148109409562516475786099319","269071949861996204582924598950710671377","208127670350810447485348960392947413884","179183749042983288980569257975022463831","309180862489004386734621066945817748629","258643581723643426900341708256308625983","230310183961395868442431071231362422798","164646445643169656225114781135517788875","202407620012173417943360537489053932801","5699347164658408327827915191286856950","267819104903165717970991980314874679582","74008888161006388016900894950509892050","252935444753998230158003991065188913110","297806270014983159528189507893572967067","179251424947887059348710996722269889488","244313634146070875358124907963787595136","233908064599028728463806744662612342954","60800529225092524856606663993270359434","185601893217247891376042144506862658272","276667241711327762224871947619248757960","284416855458008002974779057720835506073","100582887106957472016422840405270568927","183477733008757943116090659879158490913","245561939553214348096058573277712902168","154904392244993210108491970234014216229","222127278985076867815117872017476699836","71060886767088270084633731683805867337","156707773832850315328991759914538200343","53936484389657115173696714550136630357","34573346206629575750228784440238510838","156986101489405824379133506191615827310","139156068970095178566288585721966476481","229502280212259279289324089936053535158","130593814639610026290203845548300727878","68381738871275332013882370374092642913","139676496146094757431136425205617369793"],"threshold":0.9},"id":"CVE-2026-53584-45583c71","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","target":{"file":"src/libgit2/submodule.c"},"deprecated":false},{"source":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","target":{"file":"src/libgit2/submodule.c","function":"submodule_config_error"},"deprecated":false,"digest":{"function_hash":"190390390455802812816328615008147320336","length":185},"id":"CVE-2026-53584-498df9a9","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"30406406931780910979215481225003964315","length":258},"id":"CVE-2026-53584-4b9b42ef","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","target":{"function":"find_evil","file":"tests/libgit2/submodule/escape.c"},"deprecated":false},{"source":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1","target":{"function":"load_submodule_names","file":"src/libgit2/submodule.c"},"deprecated":false,"digest":{"function_hash":"226530648389372440579200610964070529722","length":1190},"id":"CVE-2026-53584-5302082f","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["20081590161418030603447731683887565616","273855338202138193768343391952584416925","204996700117750643282175216839069959388","340059142987946805301114555782757068716"],"threshold":0.9},"id":"CVE-2026-53584-5514650d","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","target":{"file":"tests/libgit2/submodule/submodule_helpers.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1","target":{"file":"src/libgit2/submodule.c","function":"git_submodule_reload"},"deprecated":false,"digest":{"length":697,"function_hash":"302563450897946914633202836142169010705"},"id":"CVE-2026-53584-5a45e215"},{"target":{"file":"src/libgit2/submodule.c","function":"git_submodule_reload"},"deprecated":false,"digest":{"function_hash":"302563450897946914633202836142169010705","length":697},"id":"CVE-2026-53584-5f019bc6","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4"},{"deprecated":false,"digest":{"length":1953,"function_hash":"36743701857299552912745355159670741707"},"id":"CVE-2026-53584-60290355","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","target":{"file":"src/libgit2/submodule.c","function":"git_submodule__lookup_with_cache"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1","target":{"file":"tests/libgit2/submodule/escape.c"},"deprecated":false,"digest":{"line_hashes":["84495065203722201020605002512175302131","98182486721848648484166429299400755388","229776523202010966620247121369408994626","268645008109449580438524566232104949730","252264274423518509169801285866902397380","329200362052666377701241940011771307169","302640951132319063435189498672136648252","301638543598882664286769829299726270526","117439246456667582861591425435757061597","193010157430748507126515746172970395289","246456065187611841541997412083998140937","139483793730865887817583680309552708731","301638543598882664286769829299726270526","264232233949598148707091147729562676370","192220434702504635068809092737288830743","181565214739106406165666222364615497144","176819852181113633403275213063315675825","253945887157242527810035643065117553829"],"threshold":0.9},"id":"CVE-2026-53584-61699874"},{"deprecated":false,"digest":{"line_hashes":["20081590161418030603447731683887565616","273855338202138193768343391952584416925","204996700117750643282175216839069959388","340059142987946805301114555782757068716"],"threshold":0.9},"id":"CVE-2026-53584-71ae4b2e","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","target":{"file":"tests/libgit2/submodule/submodule_helpers.c"}},{"signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","target":{"file":"tests/libgit2/submodule/escape.c"},"deprecated":false,"digest":{"line_hashes":["84495065203722201020605002512175302131","98182486721848648484166429299400755388","229776523202010966620247121369408994626","268645008109449580438524566232104949730","252264274423518509169801285866902397380","329200362052666377701241940011771307169","302640951132319063435189498672136648252","117439246456667582861591425435757061597","193010157430748507126515746172970395289","246456065187611841541997412083998140937","139483793730865887817583680309552708731","264232233949598148707091147729562676370","192220434702504635068809092737288830743","181565214739106406165666222364615497144","176819852181113633403275213063315675825","253945887157242527810035643065117553829"],"threshold":0.9},"id":"CVE-2026-53584-751d709a","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["84495065203722201020605002512175302131","98182486721848648484166429299400755388","229776523202010966620247121369408994626","268645008109449580438524566232104949730","252264274423518509169801285866902397380","329200362052666377701241940011771307169","302640951132319063435189498672136648252","301638543598882664286769829299726270526","117439246456667582861591425435757061597","193010157430748507126515746172970395289","246456065187611841541997412083998140937","139483793730865887817583680309552708731","301638543598882664286769829299726270526","264232233949598148707091147729562676370","192220434702504635068809092737288830743","181565214739106406165666222364615497144","176819852181113633403275213063315675825","253945887157242527810035643065117553829"],"threshold":0.9},"id":"CVE-2026-53584-7ffb69af","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","target":{"file":"tests/libgit2/submodule/escape.c"}},{"id":"CVE-2026-53584-80d889fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1","target":{"file":"tests/libgit2/submodule/escape.c","function":"find_evil"},"deprecated":false,"digest":{"length":258,"function_hash":"30406406931780910979215481225003964315"}},{"deprecated":false,"digest":{"function_hash":"23968005263352477406873290810917042956","length":1291},"id":"CVE-2026-53584-8932b412","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","target":{"file":"src/libgit2/submodule.c","function":"load_submodule_names"}},{"source":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1","target":{"file":"tests/libgit2/submodule/submodule_helpers.c"},"deprecated":false,"digest":{"line_hashes":["20081590161418030603447731683887565616","273855338202138193768343391952584416925","204996700117750643282175216839069959388","340059142987946805301114555782757068716"],"threshold":0.9},"id":"CVE-2026-53584-8cedc28d","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","target":{"file":"src/libgit2/submodule.c"},"deprecated":false,"digest":{"line_hashes":["140035700741311767051885081073103264504","102117213921216368445604755350063896486","87948301654375165942292901656849920711","202351080633657998579795430882332228953","80214970668541121393338827979181184114","168258605566392051192147152590555976691","111689921546577051560234540346387411956","193294455462261803896327101985839289518","230426462822728894942190195008853465979","221668221308977214734606759650235976459","270769537304049769107042588487393264756","162335679138367972121981542258278627912","116928575150052784033989929497074948463","209446022871047761573149856713314768941","35425203668887444935835955537369762178","247248378869790723362566718934686890172","336982741478482396907435436575208771120","78373631371826682376087984823327211168","251835234432271469859209859352395927169","141847062327034727896777589174246993672","317709028622248452038516294109135080523","178900971066171720898435763483627742705","20848137041148109409562516475786099319","269071949861996204582924598950710671377","208127670350810447485348960392947413884","170531564164866745607760592890155872806","179183749042983288980569257975022463831","309180862489004386734621066945817748629","258643581723643426900341708256308625983","164646445643169656225114781135517788875","202407620012173417943360537489053932801","5699347164658408327827915191286856950","267819104903165717970991980314874679582","74008888161006388016900894950509892050","252935444753998230158003991065188913110","297806270014983159528189507893572967067","179251424947887059348710996722269889488","244313634146070875358124907963787595136","233908064599028728463806744662612342954","60800529225092524856606663993270359434","185601893217247891376042144506862658272","276667241711327762224871947619248757960","284416855458008002974779057720835506073","100582887106957472016422840405270568927","183477733008757943116090659879158490913","245561939553214348096058573277712902168","154904392244993210108491970234014216229","222127278985076867815117872017476699836","71060886767088270084633731683805867337","156707773832850315328991759914538200343","53936484389657115173696714550136630357","34573346206629575750228784440238510838","156986101489405824379133506191615827310","139156068970095178566288585721966476481","229502280212259279289324089936053535158","130593814639610026290203845548300727878","68381738871275332013882370374092642913","139676496146094757431136425205617369793"],"threshold":0.9},"id":"CVE-2026-53584-96e2fcbc","signature_type":"Line"},{"digest":{"function_hash":"107788351409428065508247257668115007684","length":911},"id":"CVE-2026-53584-9ccea2a0","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","target":{"file":"src/libgit2/submodule.c","function":"submodule_load_each"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","target":{"file":"src/libgit2/submodule.c","function":"git_submodule_reload"},"deprecated":false,"digest":{"function_hash":"302563450897946914633202836142169010705","length":697},"id":"CVE-2026-53584-b6f6357a","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","target":{"file":"src/util/fs_path.h"},"deprecated":false,"digest":{"line_hashes":["284778548496131570997298999589520680963","50409244139806353498618115036657202339","311649424898367354028624312245316306454","12162111922096392161473525694721387469","290093881164824076923832539705728861867","85514486298652536011922390149393799265","117891897382636596493862313342892980798","60836859922387901046952995635630269495","252601166622773062336129181329677699656","243354088888844028485665473473219188835","28989487736955564145749965472504708069","89293308424436554149442397631321397899","327513995677359554093243007554912202631","133338068183833451063445911250038825372","182641116660834033679459988615538470972"],"threshold":0.9},"id":"CVE-2026-53584-bc3a5d48"},{"deprecated":false,"digest":{"function_hash":"107788351409428065508247257668115007684","length":911},"id":"CVE-2026-53584-c07f606b","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","target":{"function":"submodule_load_each","file":"src/libgit2/submodule.c"}},{"digest":{"function_hash":"107788351409428065508247257668115007684","length":911},"id":"CVE-2026-53584-cb6e5fe6","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1","target":{"function":"submodule_load_each","file":"src/libgit2/submodule.c"},"deprecated":false},{"target":{"file":"src/libgit2/submodule.c"},"deprecated":false,"digest":{"line_hashes":["140035700741311767051885081073103264504","102117213921216368445604755350063896486","87948301654375165942292901656849920711","202351080633657998579795430882332228953","80214970668541121393338827979181184114","168258605566392051192147152590555976691","111689921546577051560234540346387411956","99924476102097051143254777774616399598","230426462822728894942190195008853465979","221668221308977214734606759650235976459","270769537304049769107042588487393264756","162335679138367972121981542258278627912","236344132510429050528477209770085760404","333199108549537307740096803426842745430","32400494981141262267887101639417577497","261717283219953550718693996501655921375","197014922733066906257393958340291725459","78373631371826682376087984823327211168","251835234432271469859209859352395927169","141847062327034727896777589174246993672","317709028622248452038516294109135080523","178900971066171720898435763483627742705","20848137041148109409562516475786099319","269071949861996204582924598950710671377","208127670350810447485348960392947413884","170531564164866745607760592890155872806","179183749042983288980569257975022463831","309180862489004386734621066945817748629","258643581723643426900341708256308625983","164646445643169656225114781135517788875","202407620012173417943360537489053932801","5699347164658408327827915191286856950","51895877851870391697100521381631749548","210666915012419904340070829741769978513","138112394292239533705043874363060249063","193365868757727283536718522147597167468","68793182504483980507695785455267909526","267819104903165717970991980314874679582","74008888161006388016900894950509892050","252935444753998230158003991065188913110","297806270014983159528189507893572967067","179251424947887059348710996722269889488","244313634146070875358124907963787595136","233908064599028728463806744662612342954","60800529225092524856606663993270359434","185601893217247891376042144506862658272","276667241711327762224871947619248757960","284416855458008002974779057720835506073","100582887106957472016422840405270568927","183477733008757943116090659879158490913","245561939553214348096058573277712902168","154904392244993210108491970234014216229","222127278985076867815117872017476699836","71060886767088270084633731683805867337","156707773832850315328991759914538200343","53936484389657115173696714550136630357","34573346206629575750228784440238510838","156986101489405824379133506191615827310","139156068970095178566288585721966476481","229502280212259279289324089936053535158","8344297288046437561183424980271274048","209241843338705951968877877850799517424","182461093454132082554015247841150396744"],"threshold":0.9},"id":"CVE-2026-53584-cc8f8673","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1"},{"deprecated":false,"digest":{"length":258,"function_hash":"30406406931780910979215481225003964315"},"id":"CVE-2026-53584-d362bc1e","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/ec7371da9f359cd8293e9108e7a0b1c1b61b67c4","target":{"file":"tests/libgit2/submodule/escape.c","function":"find_evil"}},{"target":{"file":"src/util/fs_path.h"},"deprecated":false,"digest":{"line_hashes":["284778548496131570997298999589520680963","50409244139806353498618115036657202339","311649424898367354028624312245316306454","12162111922096392161473525694721387469","290093881164824076923832539705728861867","85514486298652536011922390149393799265","117891897382636596493862313342892980798","60836859922387901046952995635630269495","252601166622773062336129181329677699656","243354088888844028485665473473219188835","28989487736955564145749965472504708069","89293308424436554149442397631321397899","327513995677359554093243007554912202631","133338068183833451063445911250038825372","182641116660834033679459988615538470972"],"threshold":0.9},"id":"CVE-2026-53584-d464305c","signature_type":"Line","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1"},{"deprecated":false,"digest":{"function_hash":"146180070227448308400444078540661416671","length":1958},"id":"CVE-2026-53584-d4803a28","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/419637d3587396f5d139d6d88480eab3cd81e7a1","target":{"file":"src/libgit2/submodule.c","function":"git_submodule__lookup_with_cache"}},{"digest":{"function_hash":"190390390455802812816328615008147320336","length":185},"id":"CVE-2026-53584-fbb69c17","signature_type":"Function","signature_version":"v1","source":"https://github.com/libgit2/libgit2/commit/467c2d95ed663df722f83a5960edf568514b128c","target":{"file":"src/libgit2/submodule.c","function":"submodule_config_error"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}