{"id":"GHSA-w672-239g-c3gr","title":"Duplicate Advisory: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()","summary":"Duplicate Advisory: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()","severity":"high","cvss":6.5,"cwe":["CWE-73"],"vendor":"gitpython","product":"gitpython","ecosystem":"pip","affected":["gitpython <= 3.1.57"],"published":"2026-08-19","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:53:39Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-w672-239g-c3gr","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76217"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file"},{"url":"https://github.com/advisories/GHSA-w672-239g-c3gr"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-08T21:11:12.322Z","slug":"GHSA-w672-239g-c3gr","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-hh9p-6wh2-4mfc. This link is maintained to preserve external references.\n\n## Original Description\nGitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.\n\n## Affected packages\n\n- `gitpython <= 3.1.57`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}