Loading vulnerability…
GitPython Diffable.diff Arbitrary File Overwrite
CVE-2026-73624 is an unsafe Git option forwarding vulnerability in GitPython versions prior to 3.1.54. The Diffable.diff method does not adequately validate Git options supplied through keyword arguments. An attacker can pass the Git output option through the other parameter or output keyword argument, causing generated patch content to be written to an attacker-selected filesystem location with the privileges of the process executing GitPython.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary file overwrite or creation as the affected process user. This can compromise integrity, disrupt application or system operation, and potentially facilitate further compromise where attacker-controlled content can be written to security-sensitive or executable locations accessible to that process.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, prevent untrusted input from reaching Diffable.diff parameters that are forwarded as Git options, especially the other parameter and output keyword argument. Restrict use of wrappers or application features that expose user-controlled diff options, and run affected processes with the minimum filesystem privileges necessary to limit overwrite impact.
Patch, then assume compromise.
Upgrade GitPython to version 3.1.54 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.