PYSEC-2026-3841 GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()

Summary IndexFile.remove and Head.checkout forward kwargs into git rm and git checkout with no guard. Passing --pathspec-from-file= together with --pathspec-file-nul makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec error quotes it verbatim. GitPython...

CVE-2026-76217

GitPython versions before 3.1.58 do not validate options passed to git rm and git checkout in IndexFile.remove() and Head.checkout(). Attackers can inject --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full contents returned in GitC...

PT-2026-78399

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58 Description Insufficient validation of options passed to the git rm and git checkout commands within the IndexFile.remove and Head.checkout functions allows for arbitrary file reading. An attacker can provide...