CVE-2026-73624 in GitPython
Summary
by MITRE • 08/13/2026
GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability exists within GitPython library versions prior to 3.1.54 where the Diffable.diff method demonstrates a critical flaw in input validation that enables arbitrary file overwrite attacks. This issue stems from insufficient sanitization of git options passed through the kwargs parameter, specifically allowing attackers to inject malicious arguments that manipulate the underlying git command execution process.
The technical implementation of this vulnerability occurs when the Diffable.diff method processes user-supplied parameters without proper validation of the git command arguments. When an attacker supplies the --output argument through either the other or output keyword arguments, the system fails to sanitize these inputs before passing them to the git command. This lack of input filtering creates a path traversal condition where the git utility can be instructed to write patch content directly to arbitrary file paths on the filesystem.
The operational impact of this vulnerability extends beyond simple file overwrite capabilities as it operates at the process privilege level, meaning that any files written will inherit the permissions and privileges of the running GitPython process. This creates a significant security risk for systems where GitPython is executed with elevated privileges or in environments where file system access controls are critical. The vulnerability can be exploited to overwrite configuration files, executable scripts, or sensitive system files depending on the context in which GitPython operates.
Security practitioners should note that this vulnerability aligns with CWE-22 Path Traversal and CWE-73 Hardcoded File Name references, as it represents a classic case of unsanitized user input being passed directly to file system operations. The attack vector demonstrates characteristics consistent with ATT&CK technique T1059 Command and Scripting Interpreter where adversaries can execute commands with the privileges of the vulnerable application. Organizations using GitPython should immediately upgrade to version 3.1.54 or later where proper input validation has been implemented.
Mitigation strategies include not only upgrading to the patched version but also implementing additional defensive measures such as restricting file system permissions for GitPython processes, employing input validation at multiple layers, and monitoring for unusual file system write operations that could indicate exploitation attempts. The vulnerability highlights the importance of proper argument sanitization in any library that interfaces with system commands, particularly when dealing with user-provided parameters that may be passed directly to underlying utilities.