EUVD-2026-74844
GHSA-rw58-wc66-99g4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L reflects required authenticated access; C:H for arbitrary local file read via oracle; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.
AnalysisAI
Argument injection in GitPython 3.1.59's high-level diff API allows low-privileged remote attackers to read arbitrary filesystem paths by passing the unsanitized --no-index flag to the underlying git diff command. By chaining --no-index with the -I/--ignore-matching-lines regex filter, an attacker can construct a content-dependent Boolean oracle - issuing repeated queries that distinguish between regex match and mismatch responses to recover single-line secrets from local files. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have low-privileged authenticated access (PR:L) to a service or application that exposes GitPython's high-level diff API and does not sanitize or restrict Git options passed by the caller. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) rates this at 7.1, reflecting low-complexity network exploitation requiring only low privilege, with high confidentiality impact and no integrity or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade GitPython to version 3.1.60 or later, which resolves the argument injection by restricting disallowed options in the high-level diff API. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications running GitPython version 3.1.59 or earlier, especially those exposing the high-level diff API to authenticated users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via und
Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using
Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today