CVE-2026-76217CWE-73

CVE-2026-76217

Medium · published August 19, 2026

CVSS v3.1

6.5

EPSS

Percentile

34.3

In the wild

Unconfirmed

What it is

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.

The record

Technical detail

CVSS v3.1: 6.5 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: 7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS: 0.00412 · 34.3th percentile
Weakness: CWE-73 · External Control of File Name or Path
Published: 2026-08-19T18:17Z

Affected products (1)

Product	Versions	Fixed in
gitpython_project/gitpython	< 3.1.58	3.1.58

References (3)

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc · [email protected]https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file · [email protected]https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

19 AUG 14:02Z
GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file
cvelistv5