CVE-2026-78678: gitpython_project gitpython Argument Injection

Vulnerability summary

CVE-2026-78678 is a high (CVSS 7.1) Argument Injection vulnerability in gitpython_project gitpython. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 25-08-2026
   PublishedVulnerability first disclosed.
2. 08-10-2026
   Last modifiedVulnerability information updated.

Description

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.