CVE-2026-78675: GitPython before 3.1.59 Local File Content Disclosure via .gitmodules
GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gitpythonto a version that resolves this vulnerability.Fixed in 3.1.59 - Configuration
Ensure GitPython disables merge_includes when parsing .gitmodules (vulnerable in GitPython before 3.1.59 where it fails to disable merge_includes, allowing [include] directives to disclose local file contents).
GitPython merge_includes = disabled
Event History
Frequently Asked Questions
What must an attacker provide or cause the application to do to exploit this issue?
The attacker needs to supply a repository containing a malicious .gitmodules file with [include] directives that reference local sensitive-file paths. The application must then access repo.submodules, which triggers parsing of .gitmodules.
How is the disclosed content exposed to the application or user?
GitConfigParser raises a MissingSectionHeaderError during parsing, and the exception message embeds the first line of the referenced local file verbatim. Exposure therefore depends on where the application logs, displays, or otherwise returns that exception.
Which versions should be treated as affected?
GitPython versions before 3.1.59 are affected. Upgrading to 3.1.59 or later addresses the described behavior.