GitPython Repo Blame Unauthorized Access

The vulnerability of the Repo.blame and Repo.blameincremental functions in the GitPython library’s unsafegitrevisionoptions protection mechanism is related to the implementation or modification of arguments. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...

Duplicate Advisory: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5xxx-qhh7-9287. This link is maintained to preserve external references. Original Description GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits...

GHSA-89FF-M8WV-P99R Duplicate Advisory: GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5xxx-qhh7-9287. This link is maintained to preserve external references. Original Description GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits...

PYSEC-2026-3788

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame. Attackers can supply revision values like --contents=/etc/passwd to leak...

CVE-2026-78678

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame. Attackers can supply revision values like --contents=/etc/passwd to leak...

CVE-2026-78678: Improper Neutralization of Argument Delimiters in a Command

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame. Attackers can supply revision values like --contents=/etc/passwd to leak...

CVE-2026-78678: Improper Neutralization of Argument Delimiters in a Command

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafegitrevisionoptions guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame. Attackers can supply revision values like --contents=/etc/passwd to leak...