CVE-2026-73624: GitPython before 3.1.54 Arbitrary File Overwrite via diff
GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.54 - Compensating control
If upgrading is not immediately possible, avoid calling GitPython Diffable.diff with untrusted user-controlled parameters/kwargs that can influence the --output argument (or otherwise ensure --output is not attacker-controlled).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73624?
The severity of CVE-2026-73624 is rated high with a CVSS score of 8.1.
How do I fix CVE-2026-73624?
To fix CVE-2026-73624, update GitPython to version 3.1.54 or later.
What is the risk associated with CVE-2026-73624?
CVE-2026-73624 has a risk score of 60 which indicates a significant vulnerability.
What does CVE-2026-73624 exploit?
CVE-2026-73624 exploits an arbitrary file overwrite vulnerability in the Diffable.diff method of GitPython.
When was CVE-2026-73624 published?
CVE-2026-73624 was published on August 13, 2026.