Arbitrary File Read Vulnerability in GitPython by GitHub

CVE-2026-76217

What is CVE-2026-76217?

Earlier versions of GitPython, specifically before 3.1.58, lack proper validation for command options utilized in git rm and git checkout commands. This oversight allows attackers to exploit the '--pathspec-from-file' and '--pathspec-file-nul' parameters, enabling unauthorized access to arbitrary files that are accessible by the process. The contents of these files can be fully returned in the GitCommandError.stderr output, posing significant risks to data confidentiality.

References