Description
GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.
Published: 2026-08-25
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 02:00:00 +0000

Type Values Removed Values Added
Description GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.
Title GitPython before 3.1.59 Arbitrary File Read via Repo.blame()
First Time appeared Gitpython Project
Gitpython Project gitpython
Weaknesses CWE-88
CPEs cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:*:*:*
Vendors & Products Gitpython Project
Gitpython Project gitpython
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Gitpython Project Gitpython
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-25T01:30:35.582Z

Reserved: 2026-08-25T01:17:12.262Z

Link: CVE-2026-78678

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-25T02:16:52.313

Modified: 2026-08-25T02:16:52.313

Link: CVE-2026-78678

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-88

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')