CVE-2026-76217
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Aug 19, 2026
Vendor
unknown
Description
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.