CVE-2026-73624CWE-88

CVE-2026-73624

High · published August 13, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00553 · 45.4th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2026-08-13T16:17Z
Affected products (1)
ProductVersionsFixed in
gitpython_project/gitpython< 3.1.543.1.54
References (3)
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc · [email protected]https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff · [email protected]https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 11:28Z
    GitPython before 3.1.54 Arbitrary File Overwrite via diff
    cvelistv5