Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76219GitPython before 3.1.58 Arbitrary File Overwrite via read-tree

High 8.1

In plain English

A high-severity argument injection in GitPython from gitpython-developers. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 54.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	py3-gitpython	3.1.61-r0	ALPINE-CVE-2026-76219
Debian:12	python-git	3.1.30-1+deb12u3	DEBIAN-CVE-2026-76219
Debian:13	python-git	3.1.44-1+deb13u1	DEBIAN-CVE-2026-76219
Debian:14	python-git	3.1.61-1	DEBIAN-CVE-2026-76219
PyPI	gitpython	3.1.58	PYSEC-2026-3838
PyPI	gitpython	3.1.58	GHSA-4gmw-gg2m-w46p
Ubuntu:26.10	python-git	no fix listed	UBUNTU-CVE-2026-76219

Affected products (as reported)

Vendor	Product	Versions
gitpython-developers	GitPython	0 – before 3.1.58

Weakness: CWE-88 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

GitHub Security Advisory (GHSA-4gmw-gg2m-w46p) vendor-advisory
VulnCheck Advisory: GitPython before 3.1.58 Arbitrary File Overwrite via read-tree third-party-advisory