CVE-2026-76217
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Aug 19, 2026
CISA due date
—
The record
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79674 NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader… CWE-73
- CVE-2026-78679 GitPython before 3.1.59 contains an arbitrary file read vulnerability in… CWE-73
- CVE-2026-78675 GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules… CWE-73
- CVE-2026-62385 NLTK versions before 3.10.0 contain a path traversal vulnerability in… CWE-73
- CVE-2026-73619 GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options… CWE-73
- CVE-2026-56390 GNU Bison improperly handles grammar‑defined output paths. CWE-73
- CVE-2026-50162 oras-go is a Go library for managing OCI artifacts. CWE-73
- CVE-2026-50462 External control of file name or path in Windows Ancillary Function Driver for WinSock… CWE-73