Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 1 advisory

CVE-2026-76219

CVE-2026-76219: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityHigh8.1

    High [CVE-2026-76219] Arbitrary File Overwrite via `git read-tree` option injection

    CVE-2026-76219Source published Source updated

    GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths. A flaw was found in GitPython. By injecting specific options into the `git read-tree` command through methods like `IndexFile.from_tree`, `IndexFile.reset`, and `IndexFile.merge_tree`, without proper option validation or argument separation, an attacker can cause the application to write a git-index blob to any attacker-controlled writable path…

    Affected products in this advisory
    • Red Hat Satellite 6.19 for RHEL 9
    • Red Hat Ansible Automation Platform 2.5
    • Red Hat Ansible Automation Platform 2.6
    • Red Hat Ansible Automation Platform 2.7

    1 more entries in the full advisory.

    Source-reported affected versions
    • < 3.1.58
    Source-reported fixed versions
    • python3.12-gitpython-0:3.1.59-1.el9pc
    • ansible-automation-platform-25/controller-rhel8:1789607021
    • ansible-automation-platform-26/controller-rhel9:1789673739
    • ansible-automation-platform-27/controller-rhel9:1789580684

    12 more entries in the full advisory.

    Mitigation guidance
    • Do not pass untrusted or attacker-influenced treeish arguments to GitPython's IndexFile.from_tree, IndexFile.reset, or IndexFile.merge_tree. Upgrade to GitPython 3.1.58 or later, where option injection into `git read-tree` is fixed.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features