CVE-2026-73624

HighCVSS 8.1/10Last modified Oct 24, 2026

Description

GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-88

Affected software

Vendor	Product	Versions
gitpython-developers	GitPython	< 3.1.54

References

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxcExploit, Mitigation, Third Party Advisory
https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diffThird Party Advisory
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxcExploit, Mitigation, Third Party Advisory

Timeline

Published: Aug 13, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-736258.8GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smu CVE-2026-736267.5JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing CVE-2026-736276.0JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Tw CVE-2026-736286.1Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<te CVE-2026-736298.5Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block he CVE-2026-73638.8Use after free in Canvas in Google Chrome on Linux, ChromeOS prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code ins CVE-2026-736305.8SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is register CVE-2026-736314.3Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared acros CVE-2026-736324.3Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be share CVE-2026-736337.5Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions f CVE-2026-736347.5Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy CVE-2026-736357.5Allocation of resources without limits or throttling vulnerability in Apache Struts. When no fixed locale is configured, the locale used for