GitPython arbitrary file read and overwrite in IndexFile and TagReference

Severity: high · CVSS 8.1 · Published 2026-08-03

Executive brief

GitPython, a popular Python library for interacting with Git repositories, contains a vulnerability where certain functions fail to sanitize user-provided arguments before passing them to the underlying Git command-line tool. This allows an attacker who can influence these arguments to overwrite arbitrary files on the system or read sensitive files they should not have access to. In a worst-case scenario, an attacker could use the file overwrite capability to gain full control over the affected server by replacing critical system or configuration files.

Technical details

The vulnerability arises from unguarded forwarding of `**kwargs` to underlying Git commands in `IndexFile.checkout()` (calling `git checkout-index`) and `TagReference.create()` (calling `git tag`). Because these methods do not invoke `Git.check_unsafe_options()`, an attacker can pass dangerous flags such as `--prefix` to `checkout-index` to write repository content to arbitrary filesystem paths, or `-F` to `git tag` to read arbitrary files into the tag message. The file overwrite primitive can be escalated to remote code execution if the attacker overwrites sensitive files like `authorized_keys` or git hooks. This issue is a recurrence of a defect class previously patched in other GitPython components. A patch is available in version 3.1.57.

GitPython arbitrary file read and overwrite in IndexFile and TagReference

Executive brief

Technical details

Affected products

Timeline

References