GitPython EUVD-2026-57824

Exploitation requires that an attacker control or influence the keyword arguments (kwargs) passed to either IndexFile.checkout() or TagReference.create() in a running GitPython-based application. This typically means the attacker has low-privileged API-level access to the application layer - not a network socket directly to git. The checkout-index attack (--prefix) additionally requires that the process has filesystem write permissions to the target path outside the repository. The git tag -F attack requires read permissions on the target file. Both paths are blocked if the application validates or allowlists kwargs before forwarding to GitPython. Non-default condition: exploitation is not possible against applications that call these methods with fully static, hardcoded arguments and never accept option keys from external input.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 7.2, reflecting network-reachable exploitation at low complexity requiring low-privilege access. The VI:H/VA:H ratings capture the high integrity and availability impact of arbitrary file overwrite. Notably, the provided vector marks VC:N (no confidentiality impact) despite the -F/TagReference.create() path enabling arbitrary file reads returned in-band - this is a gap in the official vector that defenders should treat as underreported. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically; however, a working POC is documented in the GHSA, lowering the bar significantly. The vulnerability is not yet in CISA KEV, suggesting exploitation has not been confirmed at scale, but the simplicity of the call-site abuse (one extra kwarg) means any application that exposes GitPython's IndexFile.checkout() or TagReference.create() to untrusted input is immediately at risk - even a mid-sized DevOps platform or CI/CD service should treat this as urgent given the file overwrite potential. The PR:L requirement is the primary real-world limiter: an attacker must control the kwargs passed to these methods, which typically means they already have code execution or API access within the host application.

An attacker with the ability to influence kwargs passed to IndexFile.checkout() - for example, via a CI/CD platform API, a repository management web application, or a multi-tenant git hosting service - supplies prefix='/etc/' and force=True. GitPython forwards these directly to git checkout-index, which writes all tracked repository files into /etc/, potentially overwriting system configuration files such as /etc/passwd or /etc/cron.d/ entries with attacker-controlled repository content. A working proof-of-concept for this exact scenario is included in the GHSA advisory.