{"id":"GHSA-7jx3-jqcp-hhgc","title":"Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite","summary":"Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite","severity":"high","cvss":8.1,"cwe":["CWE-88"],"vendor":"gitpython","product":"gitpython","ecosystem":"pip","affected":["gitpython <= 3.1.57"],"published":"2026-08-19","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:54:24Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-7jx3-jqcp-hhgc","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76219"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree"},{"url":"https://github.com/advisories/GHSA-7jx3-jqcp-hhgc"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-08T21:11:12.321Z","slug":"GHSA-7jx3-jqcp-hhgc","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-4gmw-gg2m-w46p. This link is maintained to preserve external references.\n\n## Original Description\nGitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.\n\n## Affected packages\n\n- `gitpython <= 3.1.57`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}