Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76217GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file

Medium 6.5

In plain English

A medium-severity security flaw in GitPython from gitpython-developers. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 64.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.24	py3-gitpython	3.1.61-r0	ALPINE-CVE-2026-76217
Debian:12	python-git	3.1.30-1+deb12u3	DEBIAN-CVE-2026-76217
Debian:13	python-git	3.1.44-1+deb13u1	DEBIAN-CVE-2026-76217
Debian:14	python-git	3.1.61-1	DEBIAN-CVE-2026-76217
PyPI	gitpython	3.1.58	PYSEC-2026-3841
PyPI	gitpython	3.1.58	GHSA-hh9p-6wh2-4mfc
Ubuntu:26.10	python-git	no fix listed	UBUNTU-CVE-2026-76217

Affected products (as reported)

Vendor	Product	Versions
gitpython-developers	GitPython	0 – before 3.1.58

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-hh9p-6wh2-4mfc) vendor-advisory
VulnCheck Advisory: GitPython before 3.1.58 Arbitrary File Read via pathspec-from-file third-party-advisory