PT-2026-81150

CVE-2026-78675

Published

2026-08-10

Updated

2026-09-22

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59

Description An issue exists when parsing .gitmodules files where the software fails to disable merge includes. This allows an attacker to disclose the content of local files by using [include] directives to point to arbitrary file paths. When the repo.submodules property is accessed, the GitConfigParser function raises a MissingSectionHeaderError that includes the first line of the targeted file within the exception message.

Recommendations Update GitPython to version 3.1.59 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-73: External Control of File Name or Path

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers