CVE-2026-73620

GitPython before 3.1.57 does not guard which git options are forwarded when applications call IndexFile.checkout() or TagReference.create(), so attacker-influenced kwargs are passed through to the underlying git command. An attacker who can control those arguments can inject git options such as --prefix to overwrite arbitrary files with repository content, or -F to read arbitrary files whose contents are returned in-band. The flaw is tracked as path/option injection (CWE-22) with a CVSS 4.0 base score of 7.2 (high), requiring network access and low privileges but no user interaction. Any Python application or tooling using GitPython below 3.1.57 that passes untrusted values into these APIs is affected, while applications that never expose these methods to attacker-controlled input are largely unaffected. Exploitation has not been confirmed in the wild: it is not on CISA KEV, EPSS estimates a 0.4% probability of exploitation within 30 days, and the only public reference is the upstream advisory with a proof of concept (GHSA-3f7w-8rr8-f37f).

What to do: Upgrade to GitPython 3.1.57 or later. Audit all call sites of IndexFile.checkout() and TagReference.create() for attacker-controlled kwargs, and validate or allowlist git options so user-supplied strings like --prefix or -F cannot be forwarded to git. No in-the-wild exploitation is currently reported, but review the upstream advisory GHSA-3f7w-8rr8-f37f for details on the proof-of-concept attack paths.