GitPython: Arbitrary file read via branch name in Head.checkout()
Summary
GitPython before 3.2.0 passes the branch name of a cloned repository to git checkout without an argument separator, so a branch name starting with an option is parsed as a git option. A remote attacker who hosts a repository with a crafted default branch name, such as --pathspec-from-file=<path>, can make an application that clones the repository and calls Head.checkout() on the active branch return the contents of files the application process can read. The leak appears in GitCommandError messages, and no account or special configuration is required on the victim side.
Affected
- GitPython before 3.2.0 (GHSA lists versions <= 3.1.62 as affected)
- Tested on GitPython 3.1.62 with git 2.55.0
- Affected code: Head.checkout() in git/refs/head.py
Fixed in
- Fixed in GitPython 3.2.0 (per the GitHub Security Advisory)
- A newer release, 3.2.1, is referenced in third-party reports; this was not verified against a primary release page
Workaround
- No official workaround is published; the advisory only names the upgrade.
- Interim measure (not from a vendor source): do not clone or check out repositories from untrusted sources, and avoid calling active_branch.checkout() on them.
Exploitation
- No evidence of exploitation in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation status 'poc', automatable: yes, technical impact: partial.
- The advisory describes a reproduction; no public exploit repository or write-up was found.
- EPSS score listed at 0.00387.
Our recommendation
- Upgrade GitPython to 3.2.0 or later (3.2.1 or later is advisable).
- Identify applications and pipelines that clone user-supplied Git URLs and call Head.checkout() or active_branch.checkout().
- Until patched, do not clone untrusted repositories in those applications.
- Check whether the process running these tools can read secrets or configuration files that could leak through error messages.
- Monitor application logs for unusual GitCommandError messages.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-23mf-xhv8-69c2 github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry GHSA-23mf-xhv8-69c2 osv.dev
- GitLab advisory mirror GHSA-23mf-xhv8-69c2 advisories.gitlab.com
- Ubuntu security notice CVE-2026-110859 ubuntu.com
- Mend/Vulners record CVE-2026-110859 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:42.
Original description (NVD)
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.