Loading vulnerability…
Arbitrary File Overwrite and Read in GitPython via Unsafe Git Option Forwarding
GitPython versions before 3.1.57 fail to guard Git options forwarded through keyword arguments in IndexFile.checkout() and TagReference.create(). Attackers who control these arguments can supply unsafe options: --prefix permits overwriting arbitrary files with repository content, while -F permits reading arbitrary files and returning their contents in-band. File access is constrained by the permissions of the process executing Git.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose local files or overwrite files with repository content, compromising confidentiality and integrity. Overwriting application data or other operationally important files can also disrupt service availability. The scope depends on the filesystem permissions of the application invoking GitPython.
If you can’t patch tonight, do this now.
Until patched, prevent untrusted input from controlling keyword arguments passed to IndexFile.checkout() and TagReference.create(), using a strict allowlist of required options. Run GitPython operations with minimal filesystem privileges and isolate repository processing from sensitive files to limit potential reads and overwrites. No vendor-specific workaround is identified.
Patch, then assume compromise.
Upgrade GitPython to version 3.1.57 or later. For distribution-managed or bundled installations, apply the vendor security update that fixes CVE-2026-73620. Relevant updates include SUSE-SU-2026:4072-1 and Red Hat advisories RHSA-2026:59135 and RHSA-2026:59136; the Red Hat updates include python3.12-gitpython version 3.1.59.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.