CVE-2026-76219High· 8.1▾ TwilightA flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the `git read-tree` command through methods like `IndexFile.from_tree`, `IndexFile.reset`, …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
0.3% → 0.3%
Last analysed / modified upstream
A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the git read-tree command through methods like IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree, without proper option validation or argument separation, an attacker can cause the application to write a git-index blob to any attacker-controlled writable path, leading to data destruction.
gitpython: GitPython: Arbitrary File Overwrite via git read-tree option injection — rated Important by Red Hat. Released 2026-08-19, updated 2026-09-21.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For detailed instructions how to apply this update, refer to:
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:63385 For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. https://access.redhat.com/errata/RHSA-2026:68764 For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation. https://access.redhat.com/errata/RHSA-2026:68771
Workarounds / mitigations:
git read-tree is fixed.Affected packages:
gitpython < 3.1.58Patched in:
gitpython 3.1.58Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76220High· 8.8gitpython: GitPython: Arbitrary command execution via crafted kwargs (CVE-2026-76220)
CVE-2026-76218High· 7.5gitpython: GitPython: Remote Code Execution via malicious Git hooks (CVE-2026-76218)
CVE-2026-78679Medium· 6.5GitPython: GitPython: Arbitrary file read via TagReference.create() (CVE-2026-78679)
CVE-2026-78676Critical· 9.8gitpython: GitPython before 3.1.59 Remote Code Execution via Config Injection (CVE-2026-78676)
CVE-2026-76221High· 8.8gitpython: GitPython: Arbitrary code execution via config-name injection (CVE-2026-76221)
CVE-2026-73624High· 8.1GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs