CVE-2026-78675
High · 8.4CVSS
8.4
EPSS
0.2%
Published
Aug 25, 2026
CISA due date
—
The record
GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-79674 NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader… CWE-73
- CVE-2026-78679 GitPython before 3.1.59 contains an arbitrary file read vulnerability in… CWE-73
- CVE-2026-62385 NLTK versions before 3.10.0 contain a path traversal vulnerability in… CWE-73
- CVE-2026-76217 GitPython versions before 3.1.58 fail to validate options passed to git rm and git… CWE-73
- CVE-2026-73619 GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options… CWE-73
- CVE-2026-56390 GNU Bison improperly handles grammar‑defined output paths. CWE-73
- CVE-2026-50162 oras-go is a Go library for managing OCI artifacts. CWE-73
- CVE-2026-50462 External control of file name or path in Windows Ancillary Function Driver for WinSock… CWE-73