CVE-2026-76219

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.58

Description An arbitrary file overwrite issue exists in the IndexFile.from tree(), IndexFile.reset(), and IndexFile.merge tree() methods. These methods append caller-influenced treeish strings to the git read-tree command without proper option validation or argument separation. This allows attackers to inject the --index-output option to overwrite arbitrary files with a valid git-index blob, resulting in the destruction of existing file content at writable paths controlled by the attacker.

Recommendations Update GitPython to version 3.1.58 or later.