CVE-2026-73620: GitPython before 3.1.57 Arbitrary File Overwrite and Read
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.57
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73620?
The severity of CVE-2026-73620 is rated high with a score of 8.1.
How do I fix CVE-2026-73620?
To fix CVE-2026-73620, upgrade GitPython to version 3.1.57 or later.
What types of vulnerabilities are associated with CVE-2026-73620?
CVE-2026-73620 is associated with arbitrary file overwrite and arbitrary file read vulnerabilities.
Which versions of GitPython are affected by CVE-2026-73620?
CVE-2026-73620 affects all versions of GitPython prior to 3.1.57.
What can an attacker achieve using CVE-2026-73620?
An attacker can overwrite arbitrary files with repository content or read arbitrary files through the exploitation of CVE-2026-73620.