High [CVE-2026-73620] Arbitrary file overwrite and read via unsafe git option forwarding

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.

A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the `IndexFile.checkout()` and `TagReference.create()` functions.

This could result in significant data integrity and confidentiality impacts. This is an Important flaw in GitPython that allows an authenticated attacker to achieve arbitrary file overwrite and read capabilities.

The vulnerability stems from insufficient validation of git options passed to `IndexFile.checkout()` and `TagReference.create()`, enabling attackers to manipulate repository content or access sensitive files. This impacts several Red Hat products, including Red Hat OpenStack Platform, Red Hat Satellite, and Red Hat Ansible Automation Platform.

Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-88.

Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Satellite 6.19 for RHEL 9; and 5 more.