CVE-2026-78675 Overview
CVE-2026-78675 is a local file content disclosure vulnerability in GitPython before version 3.1.59. The library fails to disable merge_includes when parsing .gitmodules, allowing a crafted [include] directive to reference arbitrary local files. When an application accesses repo.submodules, GitConfigParser raises a MissingSectionHeaderError that embeds the first line of the targeted file verbatim in the exception message. Any tool or CI pipeline that clones untrusted repositories and enumerates submodules with GitPython is exposed to this issue. The weakness is tracked under CWE-73: External Control of File Name or Path.
Critical Impact
Attackers who supply a malicious repository can exfiltrate the first line of arbitrary local files readable by the GitPython process, including credentials, tokens, and configuration secrets.
Affected Products
- GitPython versions prior to 3.1.59
- Applications and CI/CD pipelines that call repo.submodules on untrusted repositories
- Downstream tooling that embeds GitPython for repository inspection
Discovery Timeline
- 2026-08-25 - CVE-2026-78675 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-78675
Vulnerability Analysis
GitPython parses .gitmodules using its GitConfigParser, which wraps the underlying INI-style configuration reader. The parser leaves merge_includes enabled when reading submodule metadata. As a result, an [include] directive inside a repository-controlled .gitmodules file is honored, and the parser attempts to open and inline the referenced path.
When the referenced file does not begin with a valid [section] header, the parser raises MissingSectionHeaderError. The exception message includes the first line of the file being parsed. That line is then surfaced to the calling application through the raised exception, log output, or error reporting.
Exploitation requires only that a victim invoke repo.submodules against an attacker-controlled repository. Automated systems such as dependency scanners, mirror services, and continuous integration runners are the most exposed targets.
Root Cause
The root cause is insecure default handling of configuration includes during submodule parsing. GitPython should disable merge_includes when reading .gitmodules because the file is under repository control and must be treated as untrusted input. Leaving includes enabled allows external control of a file path used by the library, matching the CWE-73 pattern.
Attack Vector
An attacker publishes a repository containing a .gitmodules file with an [include]path directive pointing at a sensitive local file such as /etc/passwd, ~/.aws/credentials, ~/.netrc, or a CI runner token file. When a victim clones the repository and any automated workflow reads repo.submodules, GitPython raises an exception whose message contains the first line of the targeted file. The message is then written to logs, build output, error trackers, or returned to the requester. Exploitation requires no authentication or user interaction beyond triggering submodule enumeration.
No public exploitation code is referenced in the advisory. Technical details are available in the GitHub Security Advisory GHSA-7833-fr7j-v32q and the VulnCheck advisory.
Detection Methods for CVE-2026-78675
Indicators of Compromise
- Presence of [include] or path = directives inside cloned .gitmodules files that reference absolute paths or paths outside the repository root
- MissingSectionHeaderError exceptions raised from GitConfigParser during submodule enumeration
- Build logs or error reports containing fragments of local files such as /etc/passwd entries, AWS keys, or token prefixes
Detection Strategies
- Statically scan every incoming repository for .gitmodules files that contain include directives before invoking GitPython APIs
- Instrument GitPython call sites to capture and inspect exception messages for filesystem paths and credential-like patterns
- Inventory Python environments to identify GitPython versions below 3.1.59 using pip list or SBOM analysis
Monitoring Recommendations
- Monitor CI/CD build logs for unexpected MissingSectionHeaderError traces from git.config modules
- Alert on repository clone operations followed by errors containing sensitive file paths
- Track outbound access from build agents to detect follow-on credential misuse if disclosure occurs
How to Mitigate CVE-2026-78675
Immediate Actions Required
- Upgrade GitPython to version 3.1.59 or later across all applications, agents, and CI runners
- Audit any service that processes untrusted repositories and calls repo.submodules or related APIs
- Rotate credentials, tokens, and keys stored on hosts that previously parsed untrusted .gitmodules files
Patch Information
The fix is available in GitPython 3.1.59, which disables merge_includes when parsing .gitmodules. Refer to the GitHub Security Advisory GHSA-7833-fr7j-v32q for release details and the corresponding commit references.
Workarounds
- Pre-scan cloned repositories and reject or sanitize any .gitmodules file containing [include] directives before invoking GitPython
- Run GitPython workloads under a dedicated low-privilege account with no access to secrets or credential files
- Wrap calls to repo.submodules in exception handlers that discard message contents to prevent secondary logging exposure
# Configuration example
pip install --upgrade 'GitPython>=3.1.59'
pip show GitPython | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
