GitPython Arbitrary File Read via Git Command Injection

Executive Summary

CVE-2026-76217 is a vulnerability in GitPython versions before 3.1.58 where the IndexFile.remove() and Head.checkout() functions fail to validate options passed to git rm and git checkout commands. Attackers can exploit this by supplying --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process. The file contents are returned in GitCommandError.stderr.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of GitPython using the command: pip show gitpython. If the version is below 3.1.58, the system is vulnerable. Additionally, review code that uses IndexFile.remove() or Head.checkout() methods for unvalidated user input passed to these functions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with local access to read sensitive files on the system where GitPython is used. The impact is limited to information disclosure, meaning attackers can view file contents but cannot modify or execute files. No additional privileges are required beyond local access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other regulations that mandate protection of personal or health information. Organizations using vulnerable GitPython versions may face legal and regulatory penalties due to data exposure.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade GitPython to version 3.1.58 or later using the command: pip install --upgrade gitpython. If upgrading is not possible, restrict access to code that uses IndexFile.remove() or Head.checkout() methods to trusted users only.

Useful 0 Not Useful 0