{"id":"GHSA-6rj2-96f5-chj9","title":"Duplicate Advisory: GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)","summary":"Duplicate Advisory: GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)","severity":"high","cvss":6.5,"cwe":["CWE-73"],"vendor":"GitPython","product":"GitPython","ecosystem":"pip","affected":["GitPython <= 3.1.58"],"published":"2026-08-25","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:10:58Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-6rj2-96f5-chj9","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create"},{"url":"https://github.com/advisories/GHSA-6rj2-96f5-chj9"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-08T20:10:03.214Z","slug":"GHSA-6rj2-96f5-chj9","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-3wxw-xv34-2frg. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.\n\n## Affected packages\n\n- `GitPython <= 3.1.58`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}