6.5Media
CVE-2026-78678GitPython before 3.1.59 Arbitrary File Read via Repo.blame()
Descripción
GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.
Debilidad (CWE):
CWE-88
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| gitpython project | gitpython | < 3.1.59 | |
| gitpython-developers | GitPython | < 3.1.59, fixed 3.1.59 |
Referencias y parches
- GitHub Security Advisory (GHSA-5xxx-qhh7-9287) vendor-advisoryExploitVendor Advisory
- VulnCheck Advisory: GitPython before 3.1.59 Arbitrary File Read via Repo.blame() third-party-advisoryThird Party Advisory
Coincidencias CPE (NVD) (1)
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*< 3.1.59