DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-78679: CVE-2026-78679: Arbitrary File Read via Command-Line Option Injection in GitPython

#security #cve #cybersecurity

CVE-2026-78679: Arbitrary File Read via Command-Line Option Injection in GitPython

Vulnerability ID: CVE-2026-78679
CVSS Score: 7.1
Published: 2026-09-08

A command-line option injection vulnerability in GitPython allows low-privilege or unauthenticated actors to read arbitrary local files. The flaw resides in the TagReference.create() function, which fails to evaluate positional arguments against the library's unsafe-option denylist, enabling the execution of native git commands with injected option flags.

TL;DR

GitPython prior to version 3.1.59 fails to validate positional parameters in TagReference.create(), enabling command-line option injection (like --file) that allows attackers to perform arbitrary file reads.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-73
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 7.1
  • EPSS Score: 0.00241
  • Impact: Arbitrary File Read / Information Disclosure
  • Exploit Status: Proof-of-Concept (PoC)
  • KEV Status: Not Listed

Affected Systems

  • Applications incorporating GitPython versions 3.1.33 through 3.1.58 that allow user control over TagReference positional parameters.
  • GitPython: >= 3.1.33, < 3.1.59 (Fixed in: 3.1.59)

Code Analysis

Commit: 1b0d2d9

Fix option check to inspect path and reference positional candidates inside TagReference.create()

Exploit Details

  • GitHub: Advisory text containing reproduction scripts and technical details.

Mitigation Strategies

  • Upgrade GitPython to version 3.1.59 or higher to receive the official security patch.
  • Implement strict input validation on all parameters passed to GitPython to ensure no string starts with a hyphen.
  • Implement least-privilege permissions on the host system to minimize the impact of file read operations.

Remediation Steps:

  1. Identify all projects and environments containing GitPython prior to version 3.1.59.
  2. Update requirements.txt, setup.py, or Pipfile to specify gitpython>=3.1.59.
  3. Run 'pip install --upgrade gitpython' to install the updated library.
  4. Verify that the TagReference.create() call blocks hyphenated values by running validation test cases.

References

Read the full report for CVE-2026-78679 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)