Vulnerability - CVE-2026-78678

›

›vulnerability›CVE-2026-78678

Name

CVE-2026-78678

Source

NVD ( link)Debian ( link)

Description

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.

CWEs

Published Date

Aug 25, 2026

Updated Date

Sep 2, 2026

Workaround

-

Advisories

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287Exploit

https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-blameThird Party Advisory

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287Exploit

Analysis#

Affected Component

Analysis

Vulnerability Ratings#

7.1

CVSSv4

6.5

CVSSv31

NaN

other

Others affected component#

Name

Project

Project Version

Version

Status

yocto

master

3.2.0

Not Affected