CVE-2026-73624 is an arbitrary file overwrite vulnerability in GitPython's Diffable.diff method present in versions before 3.1.54. The method fails to properly neutralize argument delimiters in git options passed through keyword arguments, allowing an attacker to inject the --output argument. This enables writing patch content to arbitrary file paths with the privileges of the running process, potentially leading to unauthorized file modification.

An attacker able to invoke the vulnerable Diffable.diff method can overwrite arbitrary files on the system with the privileges of the process running GitPython. This could lead to unauthorized modification of files, potentially impacting system integrity or enabling further attacks. No user interaction or elevated privileges beyond the process level are required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted input to the Diffable.diff method's keyword arguments that control git options, especially the --output parameter.