GHSA-hh9p-6wh2-4mfc: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
(updated )
IndexFile.remove() and Head.checkout() forward **kwargs into git rm and git checkout
with no guard. Passing --pathspec-from-file=<file> together with --pathspec-file-nul
makes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec
error quotes it verbatim. GitPython surfaces that through GitCommandError.stderr, so the
entire contents of a caller-chosen file are returned to the caller in band.
This is the same primitive as Instance 2 of
GHSA-3f7w-8rr8-f37f - TagReference.create()
with -F, arbitrary file read returned in band - at two sites that advisory assessed and
cleared.
References
- github.com/advisories/GHSA-hh9p-6wh2-4mfc
- github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c
- github.com/gitpython-developers/GitPython/pull/2204
- github.com/gitpython-developers/GitPython/releases/tag/3.1.58
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc
- nvd.nist.gov/vuln/detail/CVE-2026-76217
- www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file
Code Behaviors & Features
Detect and mitigate GHSA-hh9p-6wh2-4mfc with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →