PYSEC-2026-3837 GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Summary TagReference.create forwards a caller-influenced positional reference value into git tag without it ever being inspected by the unsafe-option guard, allowing an arbitrary file read the file's contents are returned in-band as the annotated tag message. This is an incomplete-fix bypass of...

SUSE CVE-2026-78679

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message...

Duplicate Advisory: GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3wxw-xv34-2frg. This link is maintained to preserve external references. Original Description GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional...

DEBIAN-CVE-2026-78679

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message...

CVE-2026-78679 GitPython before 3.1.59 Arbitrary File Read via TagReference.create

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message...

PT-2026-81154

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.59 Description An arbitrary file read issue exists in the TagReference.create function. A positional reference parameter allows the bypass of the unsafe option guard, enabling attackers to provide a reference...

CVE-2026-78679

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message...

CLSA-2026-1777456776 glibc: Fix of CVE-2021-35942

CVE-2021-35942: fix integer overflow in wordexp positional parameter number...

K18304067: The BIG-IP ASM system may fail to properly mask the value of a configured sensitive positional parameter that appears in a Referer header

Security Advisory Description The BIG-IP ASM system may fail to properly mask the value of a configured sensitive positional parameter that appears in a Referer header. This issue occurs when all of the following conditions are met: You configure a positional parameter for an Allowed URL in the...