EUVD-2026-65224

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame. Attackers can supply revision values like --contents=/etc/passwd to leak...

CVE-2026-78678

GitPython versions prior to 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits the --contents and -S options. An attacker with low privileges can supply crafted revision values (e.g., --contents=/etc/passwd) to the Repo.blame() method, enabling arbitrary fil...