EXECUTIVE SUMMARY:
Multiple vulnerabilities in GitPython expose applications that process attacker-controlled Git repositories or user-influenced GitPython parameters to arbitrary local file disclosure, arbitrary Git-directory creation, configuration injection, and potentially remote code execution. The issues arise primarily from incomplete unsafe-option validation, unsafe Git configuration parsing/serialization, and attacker-controlled Git metadata.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
Multiple vulnerabilities in GitPython expose applications that process attacker-controlled Git repositories or user-influenced GitPython parameters to arbitrary local file disclosure, arbitrary Git-directory creation, configuration injection, and potentially remote code execution. The issues arise primarily from incomplete unsafe-option validation, unsafe Git configuration parsing/serialization, and attacker-controlled Git metadata.[emaillocker id="1283"]
CVE-2026-78675 (CVSS 8.6 — High): A vulnerability in GitPython allows attackers to disclose the first line of arbitrary local files by injecting an [include] directive into a malicious .gitmodules file processed through repo.submodules.
CVE-2026-78676 (CVSS 9.3 — Critical): A vulnerability in GitPython allows attacker-controlled multiline Git configuration values to be corrupted during rewriting, potentially injecting a core.hooksPath directive and enabling arbitrary code execution when a Git hook is subsequently triggered.
CVE-2026-78678 (CVSS 6.5 — Medium): A vulnerability in GitPython allows attackers to read arbitrary local files by supplying malicious --contents or -S options to Repo.blame() or Repo.blame_incremental(), causing the targeted file's contents to be returned in the blame results.
CVE-2026-78677 (CVSS 8.7 — High): An attacker can exploit this vulnerability by passing a malicious `--separate-git-dir` argument to the `Repo.clone_from` or `Repo.clone` API, allowing them to create an arbitrary git directory outside the destination. The affected component is `.py`, specifically `Repo.unsafe_git_clone_options`.
CVE-2026-78679 (CVSS 6.5 — Medium): A vulnerability in GitPython allows attackers to read arbitrary local files by supplying a malicious reference value containing the --file option to TagReference.create(), causing the targeted file's contents to be returned as the annotated tag message.
RECOMMENDATIONS:
REFERENCES:
The following reports contain further technical details:
https://github.com/advisories/GHSA-7833-fr7j-v32q
https://github.com/advisories/GHSA-284h-m62q-gf8w
https://github.com/advisories/GHSA-5xxx-qhh7-9287
https://github.com/advisories/GHSA-8mcc-hrx5-hvxc
https://github.com/advisories/GHSA-3wxw-xv34-2frg