CVE-2026-76217 in GitPython
Summary
by MITRE • 08/19/2026
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
GitPython is a widely used Python library that provides an object-oriented interface for interacting with Git repositories, enabling developers to automate version control tasks such as committing, branching, and merging code changes. The vulnerability identified in versions prior to 3.1.58 stems from insufficient input validation within the IndexFile.remove() and Head.checkout() methods. These functions serve as wrappers around native git commands, specifically git rm and git checkout respectively. In a secure implementation, such wrapper functions should strictly sanitize or whitelist allowed command-line arguments to prevent unintended execution of auxiliary flags that alter the behavior of the underlying binary in unexpected ways.
The core technical flaw lies in how these methods handle optional parameters passed by the caller. When an attacker can control the input provided to IndexFile.remove() or Head.checkout(), they are able to inject specific git command-line options, namely --pathspec-from-file and --pathspec-file-nul. The --pathspec-from-file option instructs Git to read a list of file paths from a specified external file rather than accepting them as direct arguments. This mechanism is typically used for performance optimization or handling large numbers of files but introduces a significant security risk when combined with unvalidated input. By supplying this flag, an attacker can redirect the git binary to read arbitrary local files that are accessible to the user account executing the Python process.
The exploitation vector becomes particularly dangerous due to how GitPython handles errors and output from the underlying command execution. When the injected parameters cause Git to attempt reading a restricted or sensitive file, the operation often results in an exception being raised by the library. Specifically, this manifests as a GitCommandError object. Crucially, the error handling mechanism exposes the standard error stream (stderr) of the git process within the exception details. If the targeted file is readable but perhaps not meant to be processed via these specific commands, or if the operation fails for other reasons after reading part of the content, the contents of that arbitrary file can be returned in the stderr field of the raised exception. This effectively turns a command injection-style flaw into an arbitrary file read vulnerability with data exfiltration capabilities.
The operational impact of this vulnerability allows authenticated attackers to perform unauthorized information disclosure. Since the attack relies on reading files accessible to the process, the scope is limited by the permissions of the user account running the application. However, in many deployment scenarios, such as continuous integration pipelines or local development environments, these accounts may have broad access to configuration files, source code repositories containing secrets, environment variables stored in dotfiles, or other sensitive data residing on the filesystem. An attacker who can influence inputs to these specific GitPython methods could potentially extract credentials, private keys, internal network configurations, or proprietary intellectual property by leveraging this side-channel information leak through exception messages.
This vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and more specifically CWE-200 Exposure of Sensitive Information to an Unauthorized Actor due to the leakage of file contents via error output. From a threat modeling perspective, it represents a classic case where library convenience features are exploited through parameter injection. The attack technique corresponds to ATT&CK tactic T1537, which involves Transfer Data to Cloud Account or Local System using alternative protocols, although in this context, it is more accurately described as local data exfiltration via application error handling mechanisms rather than network-based transfer.
To mitigate this risk, organizations must immediately upgrade GitPython to version 3.1.58 or later, where the developers have implemented stricter validation and sanitization of command-line arguments passed to git rm and git checkout operations. For applications that cannot be updated instantly due to dependency constraints, a temporary workaround involves implementing custom wrappers around IndexFile.remove() and Head.checkout(). These wrappers should explicitly filter out dangerous flags such as --pathspec-from-file and --pathspec-file-nul before passing parameters to the underlying library functions. Additionally, developers should review their exception handling logic to ensure that sensitive data from stderr is not logged or exposed in production environments, thereby reducing the attack surface even if other similar vulnerabilities exist within the codebase.