CVE-2026-76219
High · 8.1CVSS
8.1
EPSS
0.5%
Published
Aug 19, 2026
CISA due date
—
The record
GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79675 NLTK before 3.10.3 fails to validate JVM options passed through the per-call options… CWE-88
- CVE-2026-78676 GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during… CWE-88
- CVE-2026-78678 GitPython versions before 3.1.59 contain an incomplete denylist in the… CWE-88
- CVE-2026-76218 GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that… CWE-88
- CVE-2026-76220 GitPython before 3.1.58 contains a command execution vulnerability in the… CWE-88
- CVE-2026-73624 GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the… CWE-88
- CVE-2026-73621 GitPython before 3.1.56 contains an argument injection vulnerability in the… CWE-88
- CVE-2026-54088 File Browser is a file managing interface for uploading, deleting, previewing, renaming… CWE-88