CVE-2026-87818

A flaw was found in GitPython. This vulnerability allows an attacker to read arbitrary files on the system by manipulating the --no-index option in the diff API. By combining this with other options, an attacker can repeatedly query local files to extract sensitive information, such as single-lin...

CVE-2026-87818

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying loc...

CVE-2026-87818 GitPython 3.1.59 Local File Content Oracle via --no-index

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying loc...

EUVD-2026-74844

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying loc...

CVE-2026-87818

GitPython 3.1.59 fails to restrict the --no-index option in its high-level diff API, allowing an authenticated remote attacker to read arbitrary filesystem paths by passing them as repository operands. By combining --no-index with -I/--ignore-matching-lines , an attacker can build a content-depen...

CVE-2026-8765 Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal

A vulnerability was detected in Kilo-Org kilocode up to 7.0.47. This vulnerability affects the function Bun.file of the file packages/opencode/src/kilocode/review/worktree-diff.ts of the component File Diff API Endpoint. Performing a manipulation of the argument File results in path traversal. It...

PT-2026-41585

Name of the Vulnerable Software and Affected Versions Kilo-Org kilocode versions prior to 7.0.48 Description A path traversal issue exists in the File Diff API Endpoint within the Bun.file function of the packages/opencode/src/kilocode/review/worktree-diff.ts file. A remote attacker can trigger...