6.5Mittel
CVE-2026-78679GitPython before 3.1.59 Arbitrary File Read via TagReference.create
Beschreibung
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.
Schwachstellentyp (CWE):
CWE-73
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| gitpython project | gitpython | < 3.1.59 | |
| gitpython-developers | GitPython | < 3.1.59, fixed 3.1.59 |
Referenzen und Patches
- GitHub Security Advisory (GHSA-3wxw-xv34-2frg) vendor-advisory
- VulnCheck Advisory: GitPython before 3.1.59 Arbitrary File Read via TagReference.create third-party-advisory