Fluid Attacks Database

Description

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	python-git	=3.1.30-1 \|\| =3.1.30-1+deb12u2 \|\| =3.1.36-1 \|\| =3.1.37-1 \|\| =3.1.37-2 \|\| =3.1.37-3 \|\| =3.1.44-1 \|\| =3.1.45-1 \|\| =3.1.46-1 \|\| =3.1.50-1 \|\| =3.1.61-1 \|\| =3.1.62-1 \|\| =3.1.62-2	-
debian 14	python-git	=3.1.44-1 \|\| =3.1.45-1 \|\| =3.1.46-1 \|\| =3.1.50-1 \|\| >=0 <3.1.61-1	3.1.61-1
debian 13	python-git	=3.1.44-1 \|\| =3.1.45-1 \|\| =3.1.46-1 \|\| =3.1.50-1 \|\| =3.1.61-1 \|\| =3.1.62-1 \|\| =3.1.62-2	-
pypi	gitpython	>=0 <3.1.58	3.1.58

Aliases

1. CVE-2026-762172. NVD-2026-762173. OSV-DEBIAN-2026-762174. OSV-2026-762175. GHSA-hh9p-6wh2-4mfc6. GCVE-2026-762177. SECURITY-TRACKER-CVE-2026-76217

References

1. https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc2. https://github.com/gitpython-developers/GitPython/pull/22043. https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c4. https://github.com/gitpython-developers/GitPython/releases/tag/3.1.585. https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.