CVE-2026-76219 GitPython before 3.1.58 Arbitrary File Overwrite via read-tree

What is CVE-2026-76219?

CVE-2026-76219 is a high-severity vulnerability in gitpython-developers GitPython, published on 19 Aug 2026.

Official description

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.

Weakness: CWE-88

Which versions are affected by CVE-2026-76219?

3 open source packages ship an affected version, including gitpython and GitPython. It affects 1 product.

Products include Gitpython Project Gitpython.

How do I fix CVE-2026-76219?

Upgrade gitpython to 3.1.58 or later.

Is CVE-2026-76219 being exploited?

There is no known exploitation of CVE-2026-76219 in the wild and no public exploit code.

Other vulnerabilities in gitpython-developers GitPython

• CVE-2023-40267 GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments Critical 9.8
• CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection Critical 9.3
• CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options Critical 9.3
• CVE-2026-42215 GitPython: Command injection via Git options bypass High 8.8
• CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-76219, ECHO-b709-0b22-8a81, GHSA-4gmw-gg2m-w46p, MINI-9572-p22h-r75m, MINI-cm3v-49x9-58xq, MINI-g3v6-f5m6-5jcw and 6 more.