GHSA-7JX3-JQCP-HHGC: gitpython PyPI
Vulnerability summary
GHSA-7JX3-JQCP-HHGC is a high (CVSS 7.2) vulnerability in gitpython PyPI.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 19-08-2026PublishedVulnerability first disclosed.
- 08-09-2026Last modifiedVulnerability information updated.
Description
Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4gmw-gg2m-w46p. This link is maintained to preserve external references. ## Original Description GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
PyPI1 product
- gitpython≤ 3.1.57
1 vendor · 1 product
