CVE-2026-110859

7.5 HIGHpublic exploit available

Published 2026-10-14 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents through GitCommandError messages.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-88

Public exploit & PoC references

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2

All references

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2
https://www.vulncheck.com/advisories/gitpython-before-3.2.0-arbitrary-file-read-via-head-checkout-branch-name
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-100369PoC
HIGHCVE-2026-100561PoC
HIGHCVE-2026-100570PoC
CRITICALCVE-2026-100714PoC
HIGHCVE-2026-102827PoC
MEDIUMCVE-2026-102904PoC
MEDIUMCVE-2026-103505PoC
HIGHCVE-2026-104715

Related by shared AI tags and CWE weakness class. Browse the full archive.