What is GHSA-mhfq-f35q-x62m?

GHSA-mhfq-f35q-x62m is a security advisory published by GitHub Security Advisories with High severity. GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and...

Which CVE IDs does GHSA-mhfq-f35q-x62m cover?

GHSA-mhfq-f35q-x62m covers the following CVE IDs: CVE-2026-73620. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mhfq-f35q-x62m?

GHSA-mhfq-f35q-x62m has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-mhfq-f35q-x62mHighCVSS 8.1

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and...

Vendor

GitHub Security Advisories

Published

August 13, 2026

Last Modified

August 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-73620 →

📋 Description

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.

🔗 References (4)

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f
https://nvd.nist.gov/vuln/detail/CVE-2026-73620
https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read
https://github.com/advisories/GHSA-mhfq-f35q-x62m