CVE-2026-78678: GitPython Information Disclosure Flaw

CVE-2026-78678 Overview

CVE-2026-78678 is an arbitrary file read vulnerability in GitPython versions before 3.1.59. The flaw exists in the unsafe_git_revision_options guard, which maintains an incomplete denylist of dangerous options. The denylist omits --contents and -S, allowing attackers to pass these options as revision values to Repo.blame(). Exploitation returns file contents through the blame result, disclosing sensitive files from the host running GitPython. The vulnerability is classified under CWE-88: Argument Injection.

Critical Impact
Attackers with the ability to influence revision arguments passed to Repo.blame() can read arbitrary files such as /etc/passwd, application secrets, or SSH keys from the host filesystem.

Affected Products

GitPython versions prior to 3.1.59
Python applications embedding GitPython for repository automation
CI/CD tooling and code-analysis platforms invoking Repo.blame() with untrusted revision input

Discovery Timeline

2026-08-25 - CVE-2026-78678 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-78678

Vulnerability Analysis

GitPython wraps the git command-line tool and forwards user-supplied arguments to subprocesses. To prevent argument injection, the library maintains a denylist named unsafe_git_revision_options that blocks options known to trigger file access or code execution when passed as revisions. The denylist is incomplete in versions before 3.1.59.

The git blame command supports the --contents=<file> option, which instructs git to use the contents of the specified file in place of the working-tree copy. It also supports -S<revs-file>, which reads revisions from an attacker-controlled path. Because neither option appears in the denylist, an attacker who controls the rev argument passed to Repo.blame() can direct git to read a file of their choice. The file contents are then returned in the blame output.

Root Cause

The root cause is a denylist-based validation strategy that fails to enumerate all dangerous git blame options. Denylists must be exhaustive to be safe, and git continues to evolve its command surface. Missing entries for --contents and -S permit argument injection through an interface that appeared safe to callers.

Attack Vector

Exploitation requires an application to call Repo.blame() with a revision value derived from attacker-controlled input, such as a web request parameter, API field, or repository metadata. The attacker supplies a value like --contents=/etc/passwd. GitPython forwards the option to git blame, and the target file contents are surfaced in the returned blame data. No authentication to git is required beyond the privileges of the process running GitPython.

A representative call pattern is repo.blame(rev=user_input, file=some_tracked_path), where user_input contains the injected option. Because the process reads files with the permissions of the host application, exploitation can disclose configuration files, private keys, and environment secrets. See the GitHub Security Advisory and the Vulncheck Advisory for further details.

Detection Methods for CVE-2026-78678

Indicators of Compromise

Blame results or application logs containing content from files unrelated to the target repository, such as /etc/passwd, .env, or SSH key material.
git blame subprocess invocations whose argument list includes --contents= or -S pointing to filesystem paths outside the repository.
Web or API requests carrying revision parameters beginning with -- or containing =/ sequences.

Detection Strategies

Inventory Python dependencies and flag any deployed GitPython version below 3.1.59 using SBOM tooling or pip list.
Perform static analysis of application code to locate calls to Repo.blame() where the rev parameter originates from untrusted input.
Instrument process auditing to capture git command lines executed by application service accounts and alert on suspicious option flags.

Monitoring Recommendations

Collect and centralize process execution telemetry from hosts running GitPython-based services and retain command-line arguments for correlation.
Monitor egress traffic and application responses for oversized or unexpected blame output that may indicate file exfiltration.
Alert on file access by application service accounts to sensitive paths that are unrelated to normal repository operations.

How to Mitigate CVE-2026-78678

Immediate Actions Required

Upgrade GitPython to version 3.1.59 or later across all environments, including build agents, worker nodes, and container images.
Audit application code for calls to Repo.blame() and validate that revision arguments cannot contain option-style values beginning with -.
Restrict the filesystem privileges of processes running GitPython so that sensitive files are not readable by the service account.

Patch Information

The maintainers addressed the issue in GitPython 3.1.59 by extending unsafe_git_revision_options to include --contents and -S. Install the patched release with pip install --upgrade "GitPython>=3.1.59" and rebuild any container images or Python virtual environments that pin an earlier version. Verify the installed version with pip show GitPython.

Workarounds

Reject any revision input that begins with - before passing it to Repo.blame() or any other GitPython API accepting revisions.
Use the -- separator convention when constructing arguments so that user-supplied values are treated as positional rather than as options.
Run GitPython-based services under least-privilege accounts and mount sensitive directories read-only or outside the process namespace.

bash

# Configuration example
pip install --upgrade "GitPython>=3.1.59"
pip show GitPython | grep -i version