High severity · published Aug 13, 2026
CVE-2026-73624
GitPython before 3.1.54 Arbitrary File Overwrite via diff
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
GitPython · gitpython-developers
before 3.1.54 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73624
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73624
vendor-advisory
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc
third-party-advisory
https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff
More from GitPython
9.8
CVE-2026-78676
GitPython before 3.1.59 Remote Code Execution via Config Injection
9.8
CVE-2026-67324
GitPython 3.1.50 Authentication Bypass via Joined Short Options
9.8
CVE-2026-42284
GitPython: Unsafe option check validates multi_options before shlex.split transforms it
8.8
CVE-2026-87817
GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
8.8
CVE-2026-76221
GitPython before 3.1.58 Config Injection via option-name