CVE-2026-78675

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59

Description An issue exists when parsing .gitmodules files where the software fails to disable merge includes. This allows an attacker to disclose the content of local files by using [include] directives to point to arbitrary file paths. When the repo.submodules property is accessed, the GitConfigParser function raises a MissingSectionHeaderError that includes the first line of the targeted file within the exception message.

Recommendations Update GitPython to version 3.1.59 or later.