CVE-2026-76219: gitpython_project gitpython Argument Injection

Vulnerability summary

CVE-2026-76219 is a high (CVSS 8.1) Argument Injection vulnerability in gitpython_project gitpython. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-08-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.