{"id":"GHSA-crmc-f4m7-33fj","title":"Duplicate Advisory: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)","summary":"Duplicate Advisory: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)","severity":"high","cvss":8.4,"cwe":["CWE-73"],"vendor":"gitpython","product":"gitpython","ecosystem":"pip","affected":["gitpython <= 3.1.58"],"published":"2026-08-25","updated":"2026-09-08","sourceUpdated":"2026-09-08T18:18:43Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-crmc-f4m7-33fj","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78675"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-local-file-content-disclosure-via-gitmodules"},{"url":"https://github.com/advisories/GHSA-crmc-f4m7-33fj"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-08T19:08:49.635Z","slug":"GHSA-crmc-f4m7-33fj","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-7833-fr7j-v32q. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.\n\n## Affected packages\n\n- `gitpython <= 3.1.58`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}