CVE-2026-110859: GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using GitPython before 3.2.0 are exposed if they clone an attacker-controlled repository and check out its active/default branch using Head.checkout().
What does an attacker need to exploit it?
The attacker needs to provide or host a repository whose default branch name is interpreted as a Git option, such as --pathspec-from-file=<path>. No authentication or user interaction is required according to the supplied vector.
What information can be disclosed?
The issue can cause arbitrary local file contents to be included in GitCommandError messages. Exposure therefore depends on whether those error messages are returned, displayed, or logged where an attacker can access them.
What should be done if an immediate upgrade is not possible?
Do not clone or check out repositories controlled by untrusted parties with affected GitPython code paths. In particular, avoid calling Head.checkout() on the active branch of untrusted repositories and restrict access to error logs that may contain leaked contents.