CVE-2026-76217

GitPython versions before 3.1.58 do not validate options passed to git rm and git checkout in IndexFile.remove() and Head.checkout(). Attackers can inject --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full contents returned in GitC...