CVE-2026-78678

🗓️ 25 Aug 2026 01:30:35Reported by MendType

mend🔗 www.mend.io👁 5 Views

Incomplete denylist in GitPython unsafe_git_revision_options allows reading arbitrary files.

Reporter	Title	Published	Views	Family All 40
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	6 Oct 202615:21	–	ibm
AlpineLinux	CVE-2026-78678	25 Aug 202601:30	–	alpinelinux
BDU FSTEC	The vulnerabilities of the Repo.blame() and Repo.blame_incremental() functions, which are part of the security mechanism for the unsafe_git_revision_options library in the Python library for interacting with Git repositories in GitPython, allow attackers to gain unauthorized access to protected information.	28 Aug 202600:00	–	bdu_fstec
Chainguard	CVE-2026-78678 vulnerabilities	16 Sep 202602:54	–	cgr
Circl	CVE-2026-78678	8 Sep 202620:35	–	circl
CVE	CVE-2026-78678	25 Aug 202601:30	–	cve
Cvelist	CVE-2026-78678 GitPython before 3.1.59 Arbitrary File Read via Repo.blame()	25 Aug 202601:30	–	cvelist
Debian CVE	CVE-2026-78678	25 Aug 202601:30	–	debiancve
EUVD	EUVD-2026-65224	8 Sep 202618:41	–	euvd
Github Security Blog	GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()	8 Sep 202618:41	–	github

Vulners

Node

OR

gitpython_project gitpythonRange1.0.1–3.1.59

gitpython_project gitpythonRange0.1.7–3.1.59

gitpython_project gitpythonRange3.1.51–3.1.59

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-78678
github	www.github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3788.yaml
vulncheck	www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-blame
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78678.json
github	www.github.com/gitpython-developers/GitPython
github	www.github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287

08 Oct 2026 00:08Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.16.5

CVSS 47.1

EPSS0.00412

SSVC

GitPython unsafe_git_revision_options Repo.blame()information disclosure arbitrary file read