CVE-2026-76219

GitPython versions before 3.1.58 contain a flaw in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree that appends caller‑supplied treeish strings directly to git read‑tree commands. The flaw allows an attacker to inject the --index-output option so that the underlying git process writes a valid git‑index blob to any file path the attacker can write to. This results in the destruction of existing file content.

The vulnerability affects the GitPython project; any installation of the library prior to release 3.1.58 on any operating system where the code receives untrusted treeish input—such as build tools, deployment scripts, or automation code—may be impacted.

The CVSS score of 7.2 indicates high severity. The EPSS score of <1% suggests a low probability of exploitation and it is not listed in CISA's KEV catalog. Based on the description, it is inferred that the likely attack vector is a local user or process that supplies a malicious treeish string to GitPython’s read‑tree methods, for example through an insecure API endpoint or command. Exploitation requires write permission to the target file path, so the threat is most relevant where the executing process runs with elevated privileges or where untrusted input can reach the API. Monitoring for unexpected file overwrites and applying the official upgrade are recommended.