GitPython CVE-2026-110859

Exploitation requires a victim application built on GitPython before 3.2.0 that clones an attacker-controlled repository and then checks out its active/default branch (calling Head.checkout() on an untrusted branch name). The attacker must control the repository's default branch name and set it to a crafted git option such as '--pathspec-from-file=<path>'. LIMITING FACTORS: only confidentiality is affected (arbitrary file read, no write/RCE); the target must process untrusted remote repos and auto-checkout, which is not universal; the file path must be readable by the process running GitPython; and the leaked content is returned via GitCommandError output, so the application must surface or log those errors to the attacker. Upgrading to GitPython 3.2.0 removes the condition entirely.

This is a credible but conditional information-disclosure flaw rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) yields 8.7 (High) driven entirely by high confidentiality impact (VC:H) with no integrity or availability impact (VI:N/VA:N) and no scope change to subsequent systems - consistent with CWE-88 argument injection enabling arbitrary file read. The network/unauthenticated/no-interaction metrics look severe in isolation, but the real-world trigger is narrower than the vector implies: exploitation requires a downstream application that uses GitPython <3.2.0 AND automatically checks out the active/default branch of an attacker-controlled repository, so the '8.7' overstates risk for environments that do not clone untrusted repos. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so exploitation probability and automatability cannot be quantified from the data given. Net: a genuine issue worth prioritizing for products/pipelines that ingest untrusted git repositories via GitPython, but likely low-to-moderate real-world risk elsewhere; treat as patch-on-schedule unless you run such clone-and-checkout automation.

An attacker publishes a malicious git repository whose default branch is named '--pathspec-from-file=/etc/passwd' (or another sensitive path). A victim service that uses GitPython to clone the repo and check out its active branch passes that branch name unsanitized to git, which interprets it as an option; the resulting GitCommandError message leaks the file's contents back to the attacker. No public exploit code was identified in the provided data.