--- id: CVE-2026-73620 title: >- gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding (CVE-2026-73620) summary: >- A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the `IndexFile.checkout()` and `TagReference.create()` functions. An authenticated attacker can exploit this by passing uns… severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cvssSource: vendor cwe: - CWE-88 - CWE-22 vendor: Red Hat product: Red Hat Satellite 6.16 for RHEL 8 affected: - exploit_intelligence - ai_inference_server - ansible_automation_platform 2 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - satellite 6 - ansible_automation_platform_2_5_for_rhel 8 - satellite_6_16_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - satellite_6_16_for_rhel 9 - satellite_6_17_for_rhel 9 - satellite_6_19_for_rhel 9 - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - openshift_ai 3.4 - satellite 6.18 - satellite 6.19 patched: - ansible_automation_platform_2_5_for_rhel 8 - satellite_6_16_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - satellite_6_16_for_rhel 9 - satellite_6_17_for_rhel 9 - satellite_6_19_for_rhel 9 - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - openshift_ai 3.4 - satellite 6.18 - satellite 6.19 published: '2026-08-13' updated: '2026-10-19' sourceUpdated: '2026-10-19T11:27:00+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73620.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73620.json - url: 'https://access.redhat.com/security/cve/CVE-2026-73620' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2515261' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-73620' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73620' - url: >- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f - url: >- https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read - url: 'https://access.redhat.com/errata/RHSA-2026:59135' - url: 'https://access.redhat.com/errata/RHSA-2026:74506' - url: 'https://access.redhat.com/errata/RHSA-2026:59136' - url: 'https://access.redhat.com/errata/RHSA-2026:74505' - url: 'https://access.redhat.com/errata/RHSA-2026:63385' - url: 'https://access.redhat.com/errata/RHSA-2026:71210' - url: 'https://access.redhat.com/errata/RHSA-2026:71179' - url: 'https://access.redhat.com/errata/RHSA-2026:67279' - url: 'https://access.redhat.com/errata/RHSA-2026:84734' - url: 'https://access.redhat.com/errata/RHSA-2026:68764' - url: 'https://access.redhat.com/errata/RHSA-2026:68771' - url: 'https://access.redhat.com/errata/RHSA-2026:68780' - url: 'https://access.redhat.com/errata/RHSA-2026:68776' - url: 'https://github.com/gitpython-developers/GitPython/pull/2193' - url: >- https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c - url: 'https://github.com/gitpython-developers/GitPython' - url: 'https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57' tags: - csaf - vex - red-hat - cve.org - exploit-available - osv - pip epss: 0.00574 epssPercentile: 0.47226 aliases: - GHSA-3f7w-8rr8-f37f ecosystem: pip exploitAvailable: true ssvc: exploitation: poc automatable: 'no' technicalImpact: total timestamp: '2026-08-13T15:01:02.645182Z' scores: vendor: 8.8 cna: 8.1 ingestedAt: '2026-08-14T19:18:45.271Z' --- ## Overview A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the `IndexFile.checkout()` and `TagReference.create()` functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to overwrite arbitrary files with repository content or read sensitive files. This could result in significant data integrity and confidentiality impacts. ## Vendor advisories - **RHSA-2026:59135** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59135) - **RHSA-2026:74506** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74506) - **RHSA-2026:59136** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59136) - **RHSA-2026:74505** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74505) - **RHSA-2026:63385** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63385) - **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210) - **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179) - **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279) - **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734) - **RHSA-2026:68764** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68764) - **RHSA-2026:68771** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68771) - **Red Hat VEX** · Important · affected: Exploit Intelligence, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6 · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Exploit Intelligence, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73620.json) - **RHSA-2026:68780** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68780) - **RHSA-2026:68776** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68776) **gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding** — rated Important by Red Hat. Released 2026-08-13, updated 2026-10-19. Affected: - Exploit Intelligence - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Fixed: - Red Hat Ansible Automation Platform 2.5 for RHEL 8 - Red Hat Satellite 6.16 for RHEL 8 - Red Hat Ansible Automation Platform 2.5 for RHEL 9 - Red Hat Ansible Automation Platform 2.6 for RHEL 9 - Red Hat Satellite 6.16 for RHEL 9 - Red Hat Satellite 6.17 for RHEL 9 - Red Hat Satellite 6.19 for RHEL 9 - Red Hat Ansible Automation Platform 2.5 - Red Hat Ansible Automation Platform 2.6 - Red Hat Ansible Automation Platform 2.7 - Red Hat OpenShift AI 3.4 - Red Hat Satellite 6.18 - Red Hat Satellite 6.19 No fix planned: - Red Hat AI Inference Server - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) 3 - Exploit Intelligence - Red Hat OpenShift AI (RHOAI) - Red Hat Satellite 6 Not affected: - Red Hat Ansible Automation Platform 2.6 for RHEL 10 - Red Hat Ansible Automation Platform 2.5 for RHEL 8 - Red Hat Ansible Automation Platform 2.5 for RHEL 9 - Red Hat Ansible Automation Platform 2.6 for RHEL 9 - Red Hat Satellite 6.19 for RHEL 9 - Red Hat Ansible Automation Platform 2.5 - Red Hat Ansible Automation Platform 2.6 - Red Hat Ansible Automation Platform 2.7 - Red Hat OpenShift AI 3.4 - Migration Toolkit for Applications 8 ## Remediation For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:59135 Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index Release Notes: Provisioning tokens are now required for all Operating System entries with Redhat family set. Attempts to download a unattended template without valid token will lead to “a provisioning token is required but a valid one was not provided” error. This changed behavior will lead to inability to use Gener… https://access.redhat.com/errata/RHSA-2026:74506 For details on how to apply this update, refer to Ansible Automation Platform documentation. https://access.redhat.com/errata/RHSA-2026:59136 Workarounds / mitigations: - Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. ## Package advisory (CVE-2026-73620) Affected packages: - `gitpython < 3.1.57` Patched in: - `gitpython 3.1.57` Source: https://osv.dev/vulnerability/GHSA-3f7w-8rr8-f37f