gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection

A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the git read-tree command through methods like IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree, without proper option validation or...

CVE-2026-76219

A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the git read-tree command through methods like IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree, without proper option validation or...

GHSA-7JX3-JQCP-HHGC Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4gmw-gg2m-w46p. This link is maintained to preserve external references. Original Description GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree,...

CVE-2026-76219: Improper Neutralization of Argument Delimiters in a Command

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...