GitPython arbitrary file overwrite in IndexFile.from_tree/reset/merge_tree

Severity: high · CVSS 8.1 · Published 2026-08-19

GitPython is a popular Python library used to interact with Git repositories. The library's file index manipulation methods (from_tree, reset, and merge_tree) fail to properly sanitize user-controlled inputs when calling git read-tree, allowing an attacker to overwrite arbitrary files on disk with git index data. An attacker with low privileges can corrupt or delete files at any writable location, causing data loss and potential service disruption.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 8.1, published 19 August 2026.
Which products and versions are affected?
GitPython Developers GitPython <= 3.1.57.
Is there a fix for This vulnerability?
A patch was published on 2026-08-04: Patched in GitPython 3.1.58 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an argument injection vulnerability (CWE-88) in GitPython's IndexFile class. The from_tree, reset (which delegates to from_tree), and merge_tree methods construct git read-tree commands by appending caller-controlled treeish arguments positionally without using check_unsafe_options guards or a -- separator. An attacker can inject the --index-output=&lt;path&gt; option to redirect the git index output to an arbitrary file path, with last-occurrence-wins behavior allowing the injected option to override the method's internal temp path. The vulnerability requires low privileges and network access to an application using GitPython, with no user interaction needed. An attacker achieves arbitrary file overwrite/destruction at the host process privileges; while the file content is constrained to a valid git-index blob (not arbitrary attacker-chosen content), the target path is fully attacker-controlled. GitPython 3.1.58 and later include fixes adding check_unsafe_options guards and/or -- separators before treeish arguments.

Affected products

  • GitPython Developers GitPython <= 3.1.57

Timeline

  • 2026-08-19: disclosed
  • 2026-08-04: patched: Patched in GitPython 3.1.58

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.