CVE-2026-76217
Description
A flaw was found in GitPython where it fails to properly validate options provided to its git rm and git checkout commands. A remote attacker with low privileges could exploit this by supplying crafted parameters, such as --pathspec-from-file and --pathspec-file-nul. This vulnerability allows for arbitrary file disclosure, enabling the attacker to read any file accessible to the GitPython process.
Statement
GitPython before 3.1.58 does not validate options passed to the underlying git rm and git checkout commands in IndexFile.remove() and Head.checkout(). An attacker able to control the path/pathspec argument passed to these methods can inject the --pathspec-from-file and --pathspec-file-nul options and read arbitrary files accessible to the process, with the file contents returned in GitCommandError.stderr.
Exploitation requires an application to pass untrusted, attacker-controlled input directly as the path/pathspec argument to these GitPython methods; in normal use these arguments are supplied by the application or developer rather than by a remote adversary. Red Hat products that bundle GitPython use it as an internal build and automation helper with developer-controlled arguments and do not expose these parameters to untrusted input, so the vulnerable code cannot be controlled by an adversary in those products, which are therefore not affected. The GitPython library packages shipped in Red Hat OpenStack Platform contain the vulnerable code; those affected streams are out of support scope for this fix. Red Hat rates the impact of this flaw as Moderate.
Mitigation
Applications using GitPython should not pass untrusted or attacker-controlled input directly as the path/pathspec argument to IndexFile.remove() or Head.checkout(), and should reject any such value beginning with a dash ("-") so that it cannot be interpreted as a git option. Updating GitPython to version 3.1.58 or later, which validates these options, resolves the issue.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic; Read Application Data; Modify Application Data
An attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified or could cause other unintended behavior.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
