CVE-2026-87818: GitPython 3.1.59 Local File Content Oracle via --no-index

Published Sep 9, 2026

Updated

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.

Affected Software

1 affected component

GitPython GitPython=3.1.59

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GitPython to a version that resolves this vulnerability.
Fixed in 3.1.59

Event History

Sep 9, 2026

CVE Published

via MITRE·11:21 AM

Data Sourced

via MITRE·11:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The vulnerability is network-reachable and requires low privileges, with no user interaction required. Exploitation depends on the attacker being able to influence arguments passed to GitPython's high-level diff API.

What kind of application behavior creates exposure?

Applications are exposed when untrusted input can supply or affect diff options and repository operands. The attacker can use the --no-index option together with ignore-matching-lines behavior to query local filesystem content through differing responses.