new file mode 100644
@@ -0,0 +1,166 @@
+From 5e0fc3555d6e9912ea9dc152252bf252fd428185 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Sun, 2 Aug 2026 09:06:40 +0000
+Subject: [PATCH 24/38] Guard read-tree index output paths
+
+<!-- agent -->
+GHSA-4gmw-gg2m-w46p reports that caller-controlled treeish arguments could
+be parsed by git read-tree as --index-output and select an arbitrary output
+path. A regression test showed that from_tree reached Git instead of raising
+UnsafeOptionError; the same unchecked path was reachable through reset and
+both merge_tree treeish positions.
+
+Add the project-standard unsafe-option guard and explicit opt-out to
+from_tree, merge_tree, and reset. Check positional and keyword candidates so
+abbreviations and alternate forwarding forms are covered before read-tree
+runs.
+
+A broader audit found only two read-tree sinks in the codebase; both are now
+guarded, and reset delegates to the guarded from_tree path. The only remaining
+index-output use is GitPython's controlled temporary index. Git cf5497b14
+confirms read-tree parses this path-taking option before tree arguments.
+Focused index tests and Ruff checks pass.
+
+CVE: CVE-2026-76219
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32]
+
+Backport Changes:
+- Omit upstream regression test changes because the current PyPI
+ source archive does not include its test suite.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 9b5dcaf85da5946dbf69dcd53f9edba08f760b32)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/index/base.py | 52 ++++++++++++++++++++++++++++++++++++++++++++--------
+ 1 file changed, 44 insertions(+), 8 deletions(-)
+
+diff --git a/git/index/base.py b/git/index/base.py
+index 687b72da..2e11f38b 100644
+--- a/git/index/base.py
++++ b/git/index/base.py
+@@ -142,6 +142,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+ """
+
+ unsafe_git_checkout_index_options = ["--prefix"]
++ unsafe_git_read_tree_options = ["--index-output"]
+
+ __slots__ = ("repo", "version", "entries", "_extension_data", "_file_path")
+
+@@ -270,8 +271,13 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+
+ @post_clear_cache
+ @default_index
+- def merge_tree(self, rhs: Treeish, base: Union[None, Treeish] = None) -> "IndexFile":
+- """Merge the given rhs treeish into the current index, possibly taking
++ def merge_tree(
++ self,
++ rhs: Treeish,
++ base: Union[None, Treeish] = None,
++ allow_unsafe_options: bool = False,
++ ) -> "IndexFile":
++ """Merge the given `rhs` treeish into the current index, possibly taking
+ a common base treeish into account.
+
+ As opposed to the :func:`IndexFile.from_tree` method, this allows you to use an
+@@ -284,6 +290,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+ Optional treeish reference pointing to the common base of 'rhs' and this
+ index which equals lhs.
+
++ :param allow_unsafe_options:
++ Allow options that may write to arbitrary paths.
++
+ :return:
+ self (containing the merge and possibly unmerged entries in case of
+ conflicts)
+@@ -294,6 +303,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+ yourself, you have to commit the changed index (or make a valid tree from
+ it) and retry with a three-way index.from_tree call.
+ """
++ if not allow_unsafe_options:
++ Git.check_unsafe_options(
++ options=Git._option_candidates([base, rhs]),
++ unsafe_options=self.unsafe_git_read_tree_options,
++ )
++
+ # -i : ignore working tree status
+ # --aggressive : handle more merge cases
+ # -m : do an actual merge
+@@ -337,8 +352,14 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+ return inst
+
+ @classmethod
+- def from_tree(cls, repo: "Repo", *treeish: Treeish, **kwargs: Any) -> "IndexFile":
+- """Merge the given treeish revisions into a new index which is returned.
++ def from_tree(
++ cls,
++ repo: "Repo",
++ *treeish: Treeish,
++ allow_unsafe_options: bool = False,
++ **kwargs: Any,
++ ) -> "IndexFile":
++ R"""Merge the given treeish revisions into a new index which is returned.
+ The original index will remain unaltered.
+
+ :param repo:
+@@ -358,6 +379,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+ :param kwargs:
+ Additional arguments passed to git-read-tree.
+
++ :param allow_unsafe_options:
++ Allow options that may write to arbitrary paths.
++
+ :return:
+ New IndexFile instance. It will point to a temporary index location which
+ does not exist anymore. If you intend to write such a merged Index, supply
+@@ -375,6 +399,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+ if len(treeish) == 0 or len(treeish) > 3:
+ raise ValueError("Please specify between 1 and 3 treeish, got %i" % len(treeish))
+
++ if not allow_unsafe_options:
++ Git.check_unsafe_options(
++ options=Git._option_candidates(treeish, kwargs),
++ unsafe_options=cls.unsafe_git_read_tree_options,
++ )
++
+ arg_list: List[Union[Treeish, str]] = []
+ # Ignore that the working tree and index possibly are out of date.
+ if len(treeish) > 1:
+@@ -1350,6 +1380,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+ working_tree: bool = False,
+ paths: Union[None, Iterable[PathLike]] = None,
+ head: bool = False,
++ allow_unsafe_options: bool = False,
+ **kwargs: Any,
+ ) -> "IndexFile":
+ """Reset the index to reflect the tree at the given commit. This will not
+@@ -1375,6 +1406,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+ The paths need to exist at the commit, otherwise an exception will be
+ raised.
+
++ :param allow_unsafe_options:
++ Allow options that may write to arbitrary paths.
++
+ :param kwargs:
+ Additional keyword arguments passed to git-reset
+
+@@ -1383,10 +1417,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+ check out the files according to their state in the index.
+ If you want git-reset like behaviour, use *HEAD.reset* instead.
+
+- :return: self"""
+- # What we actually want to do is to merge the tree into our existing
+- # index, which is what git-read-tree does.
+- new_inst = type(self).from_tree(self.repo, commit)
++ :return:
++ self
++ """
++ # What we actually want to do is to merge the tree into our existing index,
++ # which is what git-read-tree does.
++ new_inst = type(self).from_tree(self.repo, commit, allow_unsafe_options=allow_unsafe_options)
+ if not paths:
+ self.entries = new_inst.entries
+ else:
+--
+2.35.6
@@ -37,6 +37,7 @@ SRC_URI += " file://CVE-2026-42284.patch \
file://CVE-2026-73619.patch \
file://CVE-2026-76221.patch \
file://CVE-2026-76220.patch \
+ file://CVE-2026-76219.patch \
"
SRC_URI[sha256sum] = "2d99869e0fef71a73cbd242528105af1d6c1b108c60dfabd994bf292f76c3ceb"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32 [2] https://www.cve.org/CVERecord?id=CVE-2026-76219 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python/python3-git/CVE-2026-76219.patch | 166 ++++++++++++++++++ .../python/python3-git_3.1.42.bb | 1 + 2 files changed, 167 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-76219.patch