CVE-2026-78678: Gitpython Project Gitpython

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.

Affected products

• Gitpython Project Gitpython: before 3.1.59 (fixed in 3.1.59)

Published 2026-08-25. Last modified 2026-09-02.