{"id":"CVE-2026-78675","title":"GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives","summary":"GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules f…","severity":"high","cvss":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-73","CWE-200"],"vendor":"gitpython_project","product":"gitpython","affected":["gitpython < 3.1.59"],"patched":["gitpython 3.1.59"],"published":"2026-08-25","updated":"2026-10-12","sourceUpdated":"2026-10-12T15:10:00.207","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78675","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-local-file-content-disclosure-via-gitmodules","label":"disclosure@vulncheck.com"},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78675"},{"url":"https://github.com/gitpython-developers/GitPython/pull/2211"},{"url":"https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c"},{"url":"https://github.com/gitpython-developers/GitPython"},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3785.yaml"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-78675.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-78675"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523214"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78675"},{"url":"https://github.com/advisories/GHSA-7833-fr7j-v32q"}],"tags":["nvd","cve.org","exploit-available","osv","pip","csaf","vex","red-hat","ghsa","score-dispute"],"epss":0.00178,"epssPercentile":0.0729,"aliases":["GHSA-7833-fr7j-v32q","PYSEC-2026-3785"],"ecosystem":"pip","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-08-25T12:52:14.332502Z"},"scores":{"nvd":8.4,"cna":8.4,"osv":8.4,"vendor":5.5,"ghsa":8.4},"ingestedAt":"2026-09-03T19:32:11.707Z","slug":"CVE-2026-78675","body":"## Overview\n\nGitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.\n\n## Affected\n\n- `gitpython < 3.1.59`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `gitpython 3.1.59`\n\n## Package advisory (CVE-2026-78675)\n\nAffected packages:\n\n- `gitpython < 3.1.59`\n\nPatched in:\n\n- `gitpython 3.1.59`\n\nSource: https://osv.dev/vulnerability/GHSA-7833-fr7j-v32q\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), … · no fix planned: Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, … · updated 2026-09-10 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-78675.json)","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":218195,"id":"CVE-2026-78675","ts":1791478552580,"field":"exploit_available","old":"false","new":"true"},{"seq":209976,"id":"CVE-2026-78675","ts":1790234196903,"field":"cvss","old":"5.5","new":"8.4"},{"seq":209975,"id":"CVE-2026-78675","ts":1790234196903,"field":"severity","old":"medium","new":"high"},{"seq":201933,"id":"CVE-2026-78675","ts":1789399993066,"field":"cvss","old":"8.4","new":"5.5"},{"seq":201932,"id":"CVE-2026-78675","ts":1789399993066,"field":"severity","old":"high","new":"medium"},{"seq":200663,"id":"CVE-2026-78675","ts":1789397582697,"field":"cvss","old":"5.5","new":"8.4"},{"seq":200662,"id":"CVE-2026-78675","ts":1789397582697,"field":"severity","old":"medium","new":"high"},{"seq":199370,"id":"CVE-2026-78675","ts":1789395475238,"field":"cvss","old":"8.4","new":"5.5"},{"seq":199369,"id":"CVE-2026-78675","ts":1789395475238,"field":"severity","old":"high","new":"medium"},{"seq":198615,"id":"CVE-2026-78675","ts":1789392185058,"field":"cvss","old":"5.5","new":"8.4"},{"seq":198614,"id":"CVE-2026-78675","ts":1789392185058,"field":"severity","old":"medium","new":"high"},{"seq":196946,"id":"CVE-2026-78675","ts":1789384272854,"field":"cvss","old":"8.4","new":"5.5"},{"seq":196945,"id":"CVE-2026-78675","ts":1789384272854,"field":"severity","old":"high","new":"medium"},{"seq":194077,"id":"CVE-2026-78675","ts":1789378690575,"field":"cvss","old":"5.5","new":"8.4"},{"seq":194076,"id":"CVE-2026-78675","ts":1789378690575,"field":"severity","old":"medium","new":"high"},{"seq":192864,"id":"CVE-2026-78675","ts":1789376494166,"field":"cvss","old":"8.4","new":"5.5"},{"seq":192863,"id":"CVE-2026-78675","ts":1789376494166,"field":"severity","old":"high","new":"medium"},{"seq":191651,"id":"CVE-2026-78675","ts":1789373587310,"field":"cvss","old":"5.5","new":"8.4"},{"seq":191650,"id":"CVE-2026-78675","ts":1789373587310,"field":"severity","old":"medium","new":"high"},{"seq":190436,"id":"CVE-2026-78675","ts":1789369449194,"field":"cvss","old":"8.4","new":"5.5"},{"seq":190435,"id":"CVE-2026-78675","ts":1789369449194,"field":"severity","old":"high","new":"medium"},{"seq":189223,"id":"CVE-2026-78675","ts":1789368370765,"field":"cvss","old":"5.5","new":"8.4"},{"seq":189222,"id":"CVE-2026-78675","ts":1789368370765,"field":"severity","old":"medium","new":"high"},{"seq":188006,"id":"CVE-2026-78675","ts":1789365211229,"field":"cvss","old":"8.4","new":"5.5"},{"seq":188005,"id":"CVE-2026-78675","ts":1789365211229,"field":"severity","old":"high","new":"medium"},{"seq":186793,"id":"CVE-2026-78675","ts":1789363452539,"field":"cvss","old":"5.5","new":"8.4"},{"seq":186792,"id":"CVE-2026-78675","ts":1789363452539,"field":"severity","old":"medium","new":"high"},{"seq":185579,"id":"CVE-2026-78675","ts":1789361194956,"field":"cvss","old":"8.4","new":"5.5"},{"seq":185578,"id":"CVE-2026-78675","ts":1789361194956,"field":"severity","old":"high","new":"medium"},{"seq":184366,"id":"CVE-2026-78675","ts":1789358316481,"field":"cvss","old":"5.5","new":"8.4"},{"seq":184365,"id":"CVE-2026-78675","ts":1789358316481,"field":"severity","old":"medium","new":"high"},{"seq":182617,"id":"CVE-2026-78675","ts":1789354302311,"field":"cvss","old":"8.4","new":"5.5"},{"seq":182616,"id":"CVE-2026-78675","ts":1789354302311,"field":"severity","old":"high","new":"medium"},{"seq":181410,"id":"CVE-2026-78675","ts":1789353277348,"field":"cvss","old":"5.5","new":"8.4"},{"seq":181409,"id":"CVE-2026-78675","ts":1789353277348,"field":"severity","old":"medium","new":"high"},{"seq":180203,"id":"CVE-2026-78675","ts":1789350265102,"field":"cvss","old":"8.4","new":"5.5"},{"seq":180202,"id":"CVE-2026-78675","ts":1789350265102,"field":"severity","old":"high","new":"medium"},{"seq":178996,"id":"CVE-2026-78675","ts":1789348252489,"field":"cvss","old":"5.5","new":"8.4"},{"seq":178995,"id":"CVE-2026-78675","ts":1789348252489,"field":"severity","old":"medium","new":"high"},{"seq":177789,"id":"CVE-2026-78675","ts":1789346355628,"field":"cvss","old":"8.4","new":"5.5"},{"seq":177788,"id":"CVE-2026-78675","ts":1789346355628,"field":"severity","old":"high","new":"medium"},{"seq":176582,"id":"CVE-2026-78675","ts":1789343156371,"field":"cvss","old":"5.5","new":"8.4"},{"seq":176581,"id":"CVE-2026-78675","ts":1789343156371,"field":"severity","old":"medium","new":"high"},{"seq":174699,"id":"CVE-2026-78675","ts":1789334852780,"field":"cvss","old":"8.4","new":"5.5"},{"seq":174698,"id":"CVE-2026-78675","ts":1789334852780,"field":"severity","old":"high","new":"medium"},{"seq":173494,"id":"CVE-2026-78675","ts":1789333640962,"field":"cvss","old":"5.5","new":"8.4"},{"seq":173493,"id":"CVE-2026-78675","ts":1789333640962,"field":"severity","old":"medium","new":"high"},{"seq":172308,"id":"CVE-2026-78675","ts":1789331080249,"field":"cvss","old":"8.4","new":"5.5"},{"seq":172307,"id":"CVE-2026-78675","ts":1789331080249,"field":"severity","old":"high","new":"medium"},{"seq":171122,"id":"CVE-2026-78675","ts":1789328748197,"field":"cvss","old":"5.5","new":"8.4"}]}