EUVD-2026-65221

GitPython: Arbitrary local file content disclosure via include directive in untrusted .gitmodules SubmoduleConfigParser never disables mergeincludes...

CVE-2026-78675

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

DEBIAN-CVE-2026-78675

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

PYSEC-2026-3785

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

Linux Distros Unpatched Vulnerability : CVE-2026-78675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file...

CVE-2026-78675

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

PT-2026-81150

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An issue exists when parsing .gitmodules files where the software fails to disable merge includes. This allows an attacker to disclose the content of local files by using include directives to poi...

PT-2026-83104

Name of the Vulnerable Software and Affected Versions gitoxide versions prior to 0.52.1 Description The software follows symlinks when reading the worktree .gitmodules file, which allows the injection of out-of-repository bytes into submodule metadata. An attacker can create a malicious repositor...