6.5Orta
CVE-2026-78679GitPython before 3.1.59 Arbitrary File Read via TagReference.create
Açıklama
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.
Zayıflık türü (CWE):
CWE-73
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| gitpython project | gitpython | < 3.1.59 | |
| gitpython-developers | GitPython | < 3.1.59, fixed 3.1.59 |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-3wxw-xv34-2frg) vendor-advisory
- VulnCheck Advisory: GitPython before 3.1.59 Arbitrary File Read via TagReference.create third-party-advisory