CVE-2026-76219: GitPython before 3.1.58 Arbitrary File Overwrite via read-tree
GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.58 - Compensating control
Apply the fix by validating inputs and ensuring the --index-output argument is never influenced by untrusted callers, so attacker-controlled treeish strings cannot be appended to git read-tree arguments.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using GitPython versions before 3.1.58 are exposed if they call IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree with treeish strings influenced by a lower-privileged attacker.
What does an attacker need to exploit it?
The attacker needs the ability to influence a treeish string passed to one of the affected methods. They can inject the --index-output option and target a path that is writable in the context of the affected application.
What is the impact of successful exploitation?
Successful exploitation can overwrite an arbitrary writable file with a valid Git index blob. This destroys the existing contents of the targeted file and can affect integrity and availability.