GitPython: GitPython: Local file content disclosure via malicious .gitmodules (CVE-2026-78675)

Overview

A flaw was found in GitPython that could allow for local file content disclosure. This vulnerability occurs because GitPython does not properly disable merge_includes when processing .gitmodules files. An attacker could exploit this by creating a specially crafted .gitmodules file with include directives that reference sensitive local files. When a user interacts with the repository's submodules, the system may inadvertently reveal the first line of these sensitive files through an error message.

Vendor advisories

• Red Hat VEX · Moderate · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, … · updated 2026-09-10 · vex

GitPython: GitPython: Local file content disclosure via malicious .gitmodules — rated Moderate by Red Hat. Released 2026-08-25, updated 2026-09-10.

Affected:

• Exploit Intelligence
• Migration Toolkit for Applications 8
• Red Hat AI Inference Server
• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)
• Red Hat OpenStack Platform 16.2
• Red Hat OpenStack Platform 17.1
• Red Hat Satellite 6

No fix planned:

• Exploit Intelligence
• Migration Toolkit for Applications 8
• Red Hat AI Inference Server
• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux AI (RHEL AI) 3
• Red Hat OpenShift AI (RHOAI)
• Red Hat OpenStack Platform 16.2
• Red Hat OpenStack Platform 17.1
• Red Hat Satellite 6

Not affected:

• Red Hat Hardened Images

Remediation

Fix deferred

Workarounds / mitigations:

• Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. For additional information, refer to the upstream advisory at https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q.

Package advisory (CVE-2026-78675)

Affected packages:

• gitpython < 3.1.59

Patched in:

• gitpython 3.1.59

Source: https://osv.dev/vulnerability/GHSA-7833-fr7j-v32q