CVE-2026-78679 GitPython before 3.1.59 Arbitrary File Read via TagReference.create

GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message...

CVE-2026-78679

GitPython before 3.1.59 is affected by an arbitrary file read vulnerability in TagReference.create(). A positional reference parameter bypasses the unsafe option guard, allowing an attacker to supply a crafted value (e.g., --file=) that causes the target file's contents to be returned in the anno...