What is GHSA-7jx3-jqcp-hhgc?

GHSA-7jx3-jqcp-hhgc is a security advisory published by GitHub Security Advisories with High severity. Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Why does GHSA-7jx3-jqcp-hhgc have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-7jx3-jqcp-hhgc?

GHSA-7jx3-jqcp-hhgc has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-7jx3-jqcp-hhgc?

GHSA-7jx3-jqcp-hhgc affects 1 product, including: pip/gitpython:\u003c= 3.1.57.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 8, 2026

GHSA-7jx3-jqcp-hhgcHighCVSS 8.1Disclosed before NVD

Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

Vendor

GitHub Security Advisories

Published

August 19, 2026

Last Modified

September 8, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-4gmw-gg2m-w46p. This link is maintained to preserve external references.

Original Description

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths.

🎯 Affected products1

pip/gitpython:<= 3.1.57

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products1

🔗 References (4)