6.5Media
CVE-2026-78679GitPython before 3.1.59 Arbitrary File Read via TagReference.create
Descripción
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.
Debilidad (CWE):
CWE-73
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| gitpython project | gitpython | < 3.1.59 | |
| gitpython-developers | GitPython | < 3.1.59, fixed 3.1.59 |
Referencias y parches
- GitHub Security Advisory (GHSA-3wxw-xv34-2frg) vendor-advisory
- VulnCheck Advisory: GitPython before 3.1.59 Arbitrary File Read via TagReference.create third-party-advisory