Arbitrary File Overwrite Vulnerability in GitPython by GitPython Developers

CVE-2026-76219

What is CVE-2026-76219?

GitPython versions prior to 3.1.58 are susceptible to an arbitrary file overwrite vulnerability, stemming from flawed handling in the IndexFile class methods. The vulnerability arises due to the lack of option validation and argument separation when appending treeish strings to the git read-tree command. This flaw can be exploited by attackers to inject a malicious --index-output option, which enables the overwriting of files via attacker-controlled writable paths. Such vulnerabilities can lead to significant data loss and compromise the integrity of the system.

References