Vulnerabilities CVE-2026-76217

CVE-2026-76217

High

Open

TLP:CLEAR

GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.

Details

CVSS Score: 7.1
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Aug 19, 2026
Last Modified: Aug 25, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.