CVE-2026-73624: GitPython Arbitrary File Overwrite Vulnerability
Summary
CVE-2026-73624: GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Affects gitpython versions < 3.1.54. Fixed in 3.1.54. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitPython is a Python library that provides an interface to Git repositories, allowing users to interact with Git repositories programmatically. It is widely used for automating Git tasks and integrating Git functionalities into Python applications. The library supports various Git operations, making it a valuable tool for developers. However, certain versions of GitPython are vulnerable to an arbitrary file overwrite issue, which can lead to severe security risks if exploited.
Vulnerability Detail
GitPython versions prior to 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method. This vulnerability arises from the failure to validate git options passed through keyword arguments (kwargs). Attackers can exploit this flaw by supplying the --output argument through the other parameter or output kwarg, allowing them to write patch content to file paths of their choosing at the process privilege level. This can lead to unauthorized file modifications and potential system compromise.
How To Fix
Latest published version: 3.2.1 as of 23 Oct 2026
pip install --upgrade "gitpython==3.2.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.54
This is the first release that contains the fix.
pip install --upgrade "gitpython==3.1.54"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Diffable.diff method with untrusted input. Ensure that any git options passed through kwargs are validated and sanitized to prevent potential exploitation.
Conclusion
In summary, CVE-2026-73624 represents a significant security vulnerability in GitPython that can lead to arbitrary file overwrites. It is crucial for users of affected versions to update to version 3.1.54 or later to protect their applications from potential exploitation. Additionally, implementing input validation can serve as a temporary measure until an update can be applied.
See every vulnerability recorded for gitpython →
FAQ
CVE-2026-73624 is a vulnerability identifier for an arbitrary file overwrite issue found in GitPython versions before 3.1.54.
If exploited, this vulnerability can allow attackers to overwrite files on your system, potentially leading to data loss or unauthorized access.
GitPython versions prior to 3.1.54 are affected by this vulnerability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities without requiring installation.
If an immediate update is not possible, ensure that you validate and sanitize any input passed to the Diffable.diff method to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for gitpython.
