VDB
GHSA-3f7w-8rr8-f37f
GHSA-3f7w-8rr8-f37f
PUBLISHED
CVSS 8.100000381469727 HIGH
GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | mlflow | 0 |
| PyPI | GitPython | |
| chainguard | awx | 0 |
| PyPI | GitPython | 0 |
| wolfi | mlflow | 0 |
| chainguard | jupyter-all-spark-notebook | 0 |
Timeline
- Aug 3, 2026 CVE Published
- Sep 10, 2026 CVE Updated
References
- https://github.com/advisories/GHSA-3f7w-8rr8-f37f advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f url
- https://github.com/gitpython-developers/GitPython/pull/2193 patch
- https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c patch
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57 url
- https://github.com/gitpython-developers/GitPython package