{"action":"Upgrade gitpython to 3.1.54 or later.","affected":[{"fixed":"3.1.54","introduced":"0"}],"component":"gitpython","cve_ids":["CVE-2026-73624"],"ecosystem":"PyPI","epss":0.00553,"exploited":false,"fixed_versions":["3.1.54"],"ghsa_id":"GHSA-fjr4-x663-mwxc","id":"tcs_01M5KH9516W4JMQJ75C8MV9PJP","modified_at":"2026-09-29T09:00:02.996062278Z","published_at":"2026-08-13T12:17:27.617Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3995","https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-3995","url":"https://osv.dev/vulnerability/PYSEC-2026-3995"}],"summary":"GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --outp"}