{"uuid": "d3199c05-82ab-4d5b-8f9d-2c0ff46295af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3wxw-xv34-2frg", "type": "seen", "source": "https://gist.github.com/alon710/203f3e8540b97026337742aaf8fa0eb2", "content": "# CVE-2026-78679: CVE-2026-78679: Arbitrary File Read via Command-Line Option Injection in GitPython\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-78679\n\n## Summary\nA command-line option injection vulnerability in GitPython allows low-privilege or unauthenticated actors to read arbitrary local files. The flaw resides in the TagReference.create() function, which fails to evaluate positional arguments against the library's unsafe-option denylist, enabling the execution of native git commands with injected option flags.\n\n## TL;DR\nGitPython prior to version 3.1.59 fails to validate positional parameters in TagReference.create(), enabling command-line option injection (like --file) that allows attackers to perform arbitrary file reads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-73\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.1\n- **EPSS Score**: 0.00241\n- **Impact**: Arbitrary File Read / Information Disclosure\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications incorporating GitPython versions 3.1.33 through 3.1.58 that allow user control over TagReference positional parameters.\n- **GitPython**: >= 3.1.33, < 3.1.59 (Fixed in: `3.1.59`)\n\n## Mitigation\n\n- Upgrade GitPython to version 3.1.59 or higher to receive the official security patch.\n- Implement strict input validation on all parameters passed to GitPython to ensure no string starts with a hyphen.\n- Implement least-privilege permissions on the host system to minimize the impact of file read operations.\n\n**Remediation Steps:**\n1. Identify all projects and environments containing GitPython prior to version 3.1.59.\n2. Update requirements.txt, setup.py, or Pipfile to specify gitpython>=3.1.59.\n3. Run 'pip install --upgrade gitpython' to install the updated library.\n4. Verify that the TagReference.create() call blocks hyphenated values by running validation test cases.\n\n## References\n\n- [GitHub Security Advisory GHSA-3wxw-xv34-2frg](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg)\n- [CVE.org CVE Record - CVE-2026-78679](https://www.cve.org/CVERecord?id=CVE-2026-78679)\n- [GitPython v3.1.59 Release](https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59)\n- [NVD - CVE-2026-78679](https://nvd.nist.gov/vuln/detail/CVE-2026-78679)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-78679) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-08T21:28:14.089286Z"}