CVE-2026-78678
EUVD-2026-6522425.08.2026, 02:16
GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| gitpython_project | gitpython | 𝑥 < 3.1.59 |
𝑥
= Vulnerable software versions
Debian Releases