CVE-2026-76217

GitPython versions before 3.1.58 fail to validate the options passed to the underlying git commands in IndexFile.remove() and Head.checkout(), so extra arguments such as --pathspec-from-file and --pathspec-file-nul can reach git unvalidated. An attacker who can influence the arguments to these methods can point --pathspec-from-file at any path, causing git to read that file instead of the intended pathspec (CWE-73). Because the full file contents are returned in GitCommandError.stderr, the attacker gains arbitrary file read with the privileges of the process running GitPython; the CVSS 4.0 score of 7.1 (high) reflects network access, low privileges, no user interaction, and high confidentiality impact. Any Python application or service in the pip ecosystem using an affected GitPython version and passing attacker-controlled data into IndexFile.remove() or Head.checkout() is affected, while code that hardcodes these arguments is not practically exposed. Exploitation status: one public advisory/PoC exists, EPSS is low (0.4%, 29th percentile), and the issue is not in CISA KEV, so no widespread in-the-wild exploitation is currently known.

What to do: Upgrade to GitPython 3.1.58 or later. As an interim mitigation, ensure attacker-controlled input is never forwarded as git options to IndexFile.remove() or Head.checkout() (for example, reject or escape arguments beginning with '--'), and audit application code that passes user-supplied pathspecs or arguments into these calls.