UNKNOWN PyPI
CVE-2026-73620
PYSEC-2026-3949 · CVE-2026-73620 · GHSA-3f7w-8rr8-f37f
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.
Ready to move
Start Securing
Free, no credit card | First findings in minutes