CVE-2026-76217 in GitPython
Résumé
par MITRE • 19/08/2026
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.