CVE-2026-78679: GitPython before 3.1.59 Arbitrary File Read via TagReference.create
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges to invoke application functionality that calls TagReference.create() and control its positional reference argument. The supplied CVSS vector indicates network reachability, low attack complexity, no user interaction, and low privileges required.
Are default GitPython installations affected?
The issue is in TagReference.create() before version 3.1.59, but the provided data does not establish whether any particular application uses that method or exposes attacker-controlled reference values by default.
What is the impact if exploitation succeeds?
An attacker can provide a value such as --file=<path> and cause arbitrary file contents to be included in an annotated tag message. The stated impact is high confidentiality impact, with no integrity or availability impact.
What can be done if upgrading is not immediately possible?
Do not allow untrusted users to control the positional reference parameter passed to TagReference.create(). Reject option-like reference values, particularly values beginning with -- and values using --file=<path>.