Vulnerabilities

Vulnerability · GHSA-23mf-xhv8-69c2

GitPython: arbitrary file read via attacker-controlled branch name in (incomplete fix of CVE-2026-78679)

Published Oct 27, 2026 · catalog updated Oct 27, 2026 · GitPython: arbitrary file read

Last checked Oct 27, 2026, 12 days ago.

Open the advisory

Exploitation likelihood is not on this record for GHSA-23mf-xhv8-69c2. A missing EPSS score is not a low risk. Compare GitPython: arbitrary file read with the linked advisory before you change production.

Severity

High—

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Version ranges on file

Affected products

pip GitPython

> **A note on the referenced files.** This report was submitted through GitHub's private > vulnerability reporting API, which carries no attachments. Every transcript this report leans > on is reproduced **inline above**, verbatim. The file names it mentions ( , , > per-case transcripts, , , blob-sweep tables) are the local > evidence bundle those inline excerpts were extracted from, with a checksum manifest. I am happy > to send the bundle by any channel you prefer, or to open a private fork — just say which. The > PoC scripts are self-contained and reproduce the result from a clean environment. --- **Affected:** — all published releases; also @ **Verified at runtime:** GitPython with git **Date:** 2026-09-10 **Reporter:** MAXI8594 --- ## Threat model | | | |---|---| | **Attacker** | anyone who can get the application to clone a URL they control. No account, no credential, no privilege in the consuming application. | | **Pre-need** | a repository they host, with pointing at a branch whose name is the payload. A to a plain git server is enough — no filesystem access to a server is required ( ). | | **Gets** | the contents of any file the application's process can read, returned in band through the exception. recovered 34 of 34 lines. | | **Real-world likelihood** | **High.** The vulnerable consumer is six lines of ordinary code with no unusual configuration: then . is the default. Cloning user-supplied URLs is the library's central use case — CI systems, repository importers, scanners and bots. | **On severity relative to the sibling advisories.** GitHub, as CNA, scored the three prior advisories in this class at 6.5 / (CVE-2026-76217, CVE-2026-78678, CVE-2026-78679). This report asks for 7.5 / , and the difference is one measured fact: in those three, the application had to pass an attacker-influenced value into the API. Here it passes nothing — the clone materialises the hostile branch on its own and returns it ( ). If that reading is not accepted, the path via is