CVE-2026-76219
High
Description
GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.
SeverityHigh
CVSS8.1
Exploit probability—
ProductGitpython
PublishedAug 19, 2026
First seenAug 19, 2026
Weakness typeCWE-88CWE-88
How to fix
Update
- gitpython_project gitpython3.1.58 or later
- gitpython3.1.58 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gitpython_project gitpython | v < 3.1.58 | 3.1.58 |
| gitpythonPyPI | v < 3.1.58 | 3.1.58 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.