Vulnerability - CVE-2026-73624

›

›vulnerability›CVE-2026-73624

Name

CVE-2026-73624

Source

NVD ( link)Debian ( link)

Description

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.

CWEs

Published Date

Aug 13, 2026

Updated Date

Sep 28, 2026

Workaround

-

Advisories

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxcExploit

https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diffThird Party Advisory

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxcExploit

Analysis#

Affected Component

Analysis

Vulnerability Ratings#

7.2

CVSSv4

8.1

CVSSv31

NaN

other

Others affected component#

Name

Project

Project Version

Version

Status

yocto

master

3.2.0

Not Affected