Arbitrary File Overwrite Vulnerability in GitPython by GitPython Developers
CVE-2026-73620

7.2HIGH

Key Information:

Vendor

Gitpython-developers

Status
Gitpython
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73620?

The GitPython library versions prior to 3.1.57 contain a vulnerability that allows attackers to exploit git option forwarding in functions like IndexFile.checkout() and TagReference.create(). By leveraging unsafe options through kwargs, attackers could potentially overwrite arbitrary files with content from the repository or read sensitive files in-band, posing a significant risk to the integrity and confidentiality of the affected systems. It is crucial for users to update to the latest version to mitigate this vulnerability effectively.

Affected Version(s)

GitPython 0 < 3.1.57

GitPython 3.1.57

References

https://github.com/gitpython-developers/GitPython/securit...
vendor-advisory
https://www.vulncheck.com/advisories/gitpython-before-arb...
third-party-advisory

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.