Astra Linux – vulnerability in python-git

GitPython versions prior to 3.1.59 fail to disable mergeincludes when parsing .gitmodules, enabling attackers to reveal local file contents by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file containing include directives referencing sensitiv...

CVE-2026-78675: External Control of File Name or Path

GitPython before 3.1.59 fails to disable mergeincludes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...

PT-2026-85180

GitPython before 3.1.59 fails to disable merge includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via include directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when...