Read the docs
TI-2026-53324 Aliases CVE-2026-76219GHSA-4gmw-gg2m-w46p

GitPython before 3.1.58 Arbitrary File Overwrite via read-tree

Priority LOW 34CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 6 fixed, 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-88.

Summary

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00543 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial GitPython (gitpython-developers): 3.1.58GitPython (PyPI): 3.1.58Red Hat: 9 advisoriesRed Hat: 6 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gitpython-developersGitPythonbefore 3.1.583.1.58Patch availableCNA
—GitPython (PyPI)before 3.1.583.1.58Patch availableGHSA-4gmw-gg2m-w46p
  • GitPython Vendorgitpython-developers Affected before 3.1.58 Fixed in 3.1.58 Patch available CNA
  • GitPython (PyPI) Vendor— Affected before 3.1.58 Fixed in 3.1.58 Patch available GHSA-4gmw-gg2m-w46p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*before 3.1.58Vulnerablegitpython-developers
  • cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* Versions before 3.1.58 Vulnerable ·gitpython-developers

Remediation

  • Fix · CNA GitPython (gitpython-developers) Fixed in 3.1.58
  • Fix · GHSA-4gmw-gg2m-w46p GitPython (PyPI) Fixed in 3.1.58 Advisory →

Red Hat 9 advisories

  • RHSA-2026:79378 Released 2026-10-08 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9, registry.redhat.io/ansible-automation-platform-27/gateway-rhel9 +4
  • RHSA-2026:71210 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8 +4
  • RHSA-2026:71179 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
Show 6 more Red Hat advisories
  • RHSA-2026:71177 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9 +4
  • RHSA-2026:68780 Released 2026-09-17 · Red Hat rating Critical
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
  • RHSA-2026:68776 Released 2026-09-17 · Red Hat rating Critical
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:68771 Released 2026-09-17 · Red Hat rating Critical
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:68764 Released 2026-09-17 · Red Hat rating Critical
    Technical preview of the satellite/iop-vmaas-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vmaas-rhel9
  • RHSA-2026:63385 Released 2026-09-03 · Red Hat rating Important
    Satellite 6.19.4 Async Update
    • Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    gitpython-developers GitPython 3.1.58

    6 records Highest priority Priority HIGH 1 HIGH, 3 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-53327 GitPython before 3.1.58 Path Traversal via .gitmodules Submodule NamePriority HIGH 70
    • TI-2026-53322 GitPython before 3.1.58 Arbitrary File Read via pathspec-from-filePriority MEDIUM 64
    • TI-2026-53326 GitPython before 3.1.58 Config Injection via option-namePriority MEDIUM 40
    Show all 6 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:71210
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:71179
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:71177, RHSA-2026:79378
Red Hat Satellite 6.18Fixed RHSA-2026:68764, RHSA-2026:68771
Red Hat Satellite 6.19Fixed RHSA-2026:68776, RHSA-2026:68780
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:63385
Not affected: 14 products
  • Exploit Intelligence
  • Migration Toolkit for Applications 8
  • Pen Drive Powered by Red Hat Lightspeed
  • Red Hat AI Inference Server
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Hardened Images
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76219
  2. 2026-10-03 Alias added: GHSA-4gmw-gg2m-w46p
  3. 2026-10-09 Fix available: RHSA-2026:79378 · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-11-06 Fix available: RHSA-2026:71177 · Red Hat

References

Exploit 1

Advisory 1

Other 4

  • TI-2026-54689 GitPython before 3.1.59 Path Traversal via separate-git-dir CVSS 4.0HIGH 8.7
  • TI-2026-51706 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() CVSS 4.0HIGH 8.7
  • TI-2026-47618 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from CVSS 4.0HIGH 8.7
  • TI-2026-30595 GitPython: Unsafe option check validates multi_options before shlex.split transforms it CVSS 3.1CRITICAL 9.8
  • TI-2026-32220 GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository CVSS 4.0HIGH 7.8
  • TI-2026-47621 GitPython before 3.1.51 Command Injection via option prefix abbreviation CVSS 4.0HIGH 8.7
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences