Executive brief
GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
Affected products
- PyPI gitpython
Junglewise Threat Intelligence
CVE-2026-76217: PYSEC-2026-3841 - GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
CVE-2026-76217 · Severity: low · CVSS 3.1 · Published 2026-09-10
Vendors: PyPI.
Related threats
- PYSEC-2026-3843 - GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
- PYSEC-2026-3840 - GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
- PYSEC-2026-3838 - GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
- GitPython ReDoS via catastrophic backtracking in Actor.name_email_regex
- GitPython argument injection in diff API via --no-index