Search: CVE-2026-110859

GitPython versions before 3.2.0 contain an argument injection vulnerability in the Head.checkout() function. This flaw allows remote attackers to read arbitrary files by supplying a specially crafted branch name that is interpreted as a git option. Specifically, an attacker can host a repository with a default branch named --pathspec-from-file=<path>, causing cloning applications that check out the active branch to leak file contents via GitCommandError messages.