{"id":"GHSA-89ff-m8wv-p99r","title":"Duplicate Advisory: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()","summary":"Duplicate Advisory: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()","severity":"high","cvss":6.5,"cwe":["CWE-88"],"vendor":"gitpython","product":"gitpython","ecosystem":"pip","affected":["gitpython <= 3.1.58"],"published":"2026-08-25","updated":"2026-09-08","sourceUpdated":"2026-09-08T18:41:22Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-89ff-m8wv-p99r","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78678"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-blame"},{"url":"https://github.com/advisories/GHSA-89ff-m8wv-p99r"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-08T19:08:49.634Z","slug":"GHSA-89ff-m8wv-p99r","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-5xxx-qhh7-9287. This link is maintained to preserve external references.\n\n## Original Description\nGitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.\n\n## Affected packages\n\n- `gitpython <= 3.1.58`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}