CVE-2026-76219 describes an arbitrary file overwrite vulnerability in GitPython prior to version 3.1.58. The flaw exists in the IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods, which append caller-controlled treeish strings directly to git read-tree commands without validating or separating arguments. This improper neutralization of argument delimiters allows an attacker to inject the --index-output option, causing git read-tree to overwrite arbitrary files with attacker-controlled git-index blobs. The vulnerability requires low attack complexity and no user interaction but does require some privileges (PR:L).

Successful exploitation allows an attacker to overwrite arbitrary files on the filesystem at paths writable by the attacker, potentially destroying or altering critical files. This can lead to data loss or corruption. The vulnerability does not require user interaction and has a high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable GitPython versions in untrusted environments or restrict input to the affected methods to trusted sources only.