CVE-2026-76219
Received Received - Intake

GitPython Arbitrary File Overwrite via IndexFile Methods

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76219
EUVD
EUVD-2026-62460

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gitpython gitpython to 3.1.58 (exc)
gitpython_developers gitpython to 3.1.58 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects GitPython versions before 3.1.58. It allows attackers to overwrite arbitrary files by injecting the --index-output option into git read-tree commands. The issue occurs in methods like IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree where user-controlled treeish strings are passed without validation or argument separation.

Detection Guidance

Check GitPython version with pip show GitPython. If version is below 3.1.58, the system is vulnerable. Review code using IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree methods for unsafe treeish string handling.

Impact Analysis

An attacker could overwrite critical files on your system with valid Git index blobs, leading to data corruption or destruction. This could disrupt applications, cause system instability, or allow further exploitation depending on which files are overwritten.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to potential unauthorized file overwrites. GDPR requires protecting personal data integrity, while HIPAA mandates safeguarding protected health information. Arbitrary file overwrites may destroy or corrupt sensitive data, violating these regulations.

Mitigation Strategies

Upgrade GitPython to version 3.1.58 or later immediately. Review and update any code using affected methods to ensure proper argument validation and separation. Restrict write permissions on sensitive directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76219. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart