Arbitrary File Reading Vulnerability in GitPython by GitPython Developers

CVE-2026-78678

What is CVE-2026-78678?

GitPython versions prior to 3.1.59 are affected by an incomplete denylist in the unsafe_git_revision_options guard, specifically missing the --contents and -S options. This oversight allows malicious actors to exploit the Repo.blame() function to read and leak arbitrary files, such as sensitive system files. By passing specially crafted revision values like --contents=/etc/passwd, attackers can access unauthorized file contents and compromise the security of the system.

References