Search: CVE-2026-110859

GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method that allows an attacker to read arbitrary files on the system by controlling the branch name. This occurs because the branch name, passed as a positional argument, is not properly sanitized and can inject unsafe git checkout options such as --pathspec-from-file, leading to disclosure of sensitive files like /etc/passwd. The vulnerability arises from an incomplete fix of prior advisories that only guarded keyword arguments but missed positional argument checks in Head.checkout().