PT-2026-81153

CVE-2026-78678

Published

2026-08-10

Updated

2026-09-18

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59

Description An incomplete denylist in the unsafe git revision options guard fails to include the --contents and -S options. This allows an attacker to read arbitrary files by passing these options to the Repo.blame() function. For example, providing a revision value such as --contents=/etc/passwd can leak the contents of sensitive files through the result returned to the caller.

Recommendations Update GitPython to version 3.1.59 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-88: Improper Neutralization of Argument Delimiters in a Command (\'Argument Injection\')

Related identifiers