This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-76217 →

DEBIAN-CVE-2026-76217

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attack...

Original description

The description as published by the source.

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.61-1"}]}]

References

advisory security-tracker.debian.org