GHSA-hh9p-6wh2-4mfc: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
(updated )
IndexFile.remove() and Head.checkout() forward **kwargs into git rm and git checkout
with no guard. Passing --pathspec-from-file=<file> together with --pathspec-file-nul
makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec
error quotes it verbatim. GitPython surfaces that through GitCommandError.stderr, so the
entire contents of a caller-chosen file are returned to the caller in band.
This is the same primitive as Instance 2 of
GHSA-3f7w-8rr8-f37f - TagReference.create()
with -F, arbitrary file read returned in band - at two sites that advisory assessed and
cleared.
References
- github.com/advisories/GHSA-hh9p-6wh2-4mfc
- github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c
- github.com/gitpython-developers/GitPython/pull/2204
- github.com/gitpython-developers/GitPython/releases/tag/3.1.58
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc
- nvd.nist.gov/vuln/detail/CVE-2026-76217
- www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file
Code Behaviors & Features
Detect and mitigate GHSA-hh9p-6wh2-4mfc with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →