GitPython CVE-2026-78675

Two conditions must be simultaneously satisfied: (1) the attacker must be able to introduce a .gitmodules file containing a malicious [include] directive into a repository that is subsequently processed by the vulnerable GitPython instance - achievable by hosting an attacker-controlled repository for cloning, by contributing a malicious commit to a shared repository, or by having local write access to a repository on the target filesystem; and (2) the application must execute a code path that calls repo.submodules on the affected repository. A third environmental constraint applies: the target file referenced by the include directive must be readable by the OS user account under which GitPython is running - files exclusively readable by root are inaccessible if the application runs as an unprivileged service account. Each exploitation event discloses only the first line of the target file, meaning repeated invocations with different target paths would be required for broader reconnaissance. Exploitation does not require authenticated network access to the victim host when the malicious .gitmodules is delivered via a repository clone.

The CVSS 4.0 base score of 8.6 with AV:L/AC:L/AT:N/PR:N reflects that exploitation is locally scoped but requires no elevated privileges or special attack prerequisites. The provided VI:H and VA:H impact ratings in the vendor-supplied vector appear inconsistent with the described behavior, which confirms only the disclosure of the first line of a target file per triggered exception - this more precisely maps to high confidentiality impact with negligible integrity impact and limited availability disruption from uncaught exceptions propagating through calling code. No EPSS score was provided, and KEV status is absent, meaning no confirmed active exploitation exists at time of analysis. Real-world risk is most acute for automated GitPython-based pipelines (CI/CD systems, repository mirrors, code analysis tools) that process untrusted external repositories and whose exception traces are logged or returned in API responses - those represent the realistic exfiltration channel. The per-invocation limit of one disclosed line constrains bulk exfiltration but does not eliminate risk for high-value targets like token files or private keys whose secrets appear on the first line.

An attacker publishes a malicious git repository whose .gitmodules contains an [include] directive pointing to /proc/self/environ or a known credential file path on Linux targets. A CI/CD pipeline using GitPython clones this repository and iterates repo.submodules to detect submodule changes. GitConfigParser follows the include directive, attempts to parse the target file as a Git config, and raises MissingSectionHeaderError embedding the file's first line - which may contain environment variables including API keys or tokens - in the exception text. If the pipeline logs stack traces to a centralized logging system accessible to the attacker, the content is recovered. No confirmed public POC is referenced in available intelligence.