CVE-2026-87818

Name of the Vulnerable Software and Affected Versions GitPython version 3.1.59

Description The high-level diff API fails to restrict the --no-index option, which allows attackers to read arbitrary filesystem paths as repository operands. By combining --no-index with -I/--ignore-matching-lines, an attacker can create a content-dependent Boolean oracle. This technique enables the recovery of single-line secrets from local files by analyzing the difference between success and error responses. This issue can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.