Argument Injection Vulnerability in GitPython Affects Remote File Access

CVE-2026-110859

What is CVE-2026-110859?

GitPython prior to version 3.2.0 is susceptible to an argument injection vulnerability in the Head.checkout() function. This flaw enables remote attackers to read arbitrary files by manipulating branch names that are interpreted as Git options. By crafting a repository with a default branch named '--pathspec-from-file=', an attacker can exploit this vulnerability to expose file contents through GitCommandError messages when cloning operations request the active branch. This vulnerability underscores the importance of validating user inputs in software interactions to prevent unauthorized access to sensitive file data.

References