CVE-2026-73620
HighCVSS 8.1Summary
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.
Risk Assessment
An attacker could overwrite or read arbitrary files on the server, potentially leading to data integrity compromise or disclosure of sensitive information.
Recommendation
Upgrade GitPython to version 3.1.57 or later.
Original NVD description (English source)
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.