CVE-2026-87818

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-whh4-5q6c-9v3x. This link is maintained to preserve external references.

Original Description

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.

Summary

GitPython 3.1.59 blocks a previously available local-file read path through unsafe git diff options such as -O/--orderfile.

However, the high-level diff API still permits --no-index with the default allow_unsafe_options=False.

--no-index changes the semantics of the paths arguments: instead of repository-relative pathspecs, Git interprets them as arbitrary filesystem paths.

When combined with the still-allowed -I/--ignore-matching-lines option, this creates a content-dependent Boolean oracle over a caller-selected local file.

This was reproduced against the published GitPython 3.1.59 wheel.

The original unsafe-option path is blocked in 3.1.59, while this alternate path remains reachable without setting allow_unsafe_options=True.

Details

Confirmed API surface:

repo.index.diff( None, no_index=True, I=pattern, paths=[baseline_path, target_path], create_patch=True, )

The relevant behavior is:

1. --no-index makes the two values supplied via paths filesystem operands rather than repository pathspecs.
2. -I/--ignore-matching-lines makes Git's result depend on whether the supplied regular expression matches the relevant file content.
3. GitPython exposes the resulting bit through distinguishable behavior:
   • matching condition: normal return with an empty DiffIndex
   • non-matching condition: GitCommandError with exit status 1

An application that forwards attacker-influenced diff options and paths and exposes the success/error distinction can therefore be queried repeatedly to recover a guessable local single-line secret.

The issue was confirmed with the default allow_unsafe_options=False.

The behavior does not require the caller to explicitly opt into GitPython's unsafe-option mode.

Verified intended security boundary:

• GitPython 3.1.58 accepts the earlier -O/--orderfile local-file input path.
• GitPython 3.1.59 rejects that same path with UnsafeOptionError.
• GitPython 3.1.59 still permits the --no-index alternate path described above.

This appears to be an alternate route to the same local-file confidentiality property that the 3.1.59 diff option hardening is intended to protect.

PoC

A minimal reproducer, controlled extraction demonstrator, proof matrix, and proposed remediation are included in the attached package.

gitpython-3159-maintainer-evidence.zip

The minimal reproducer creates only temporary researcher-controlled files and demonstrates the following predicate:

correct prefix -> normal GitPython return incorrect prefix -> GitCommandError(status=1)

In the controlled extraction test, I generated three independent random single-line values and recovered all three exactly through repeated calls to the GitPython high-level API.

Result: 3/3 recovered.

The extraction harness also installs a Python audit hook that rejects direct Python open() access to the target file during the oracle phase. The content-dependent read is therefore performed by the child git process invoked through GitPython rather than by the reproduction script directly.

Controls were also tested:

• normal repository-scoped diff: no secret disclosure
• same outside paths without --no-index: no arbitrary-filesystem interpretation
• deliberately incorrect predicate: status 1 as expected

Suggested remediation is to classify --no-index as unsafe for the high-level diff API unless the caller explicitly sets allow_unsafe_options=True.

Impact

Potential impact is disclosure of local files readable by the process running GitPython.

Exploitation requires an embedding application to allow an attacker to influence:

1. the relevant diff options,
2. both path operands, and
3. repeated requests while exposing a distinguishable success/error result.

The demonstrated attack is a blind content oracle rather than a one-request in-band file read. It is particularly applicable to short or structured…

**GitPython*is a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files support.With the new object database abstraction added in 0.3, its even possible to implement your own storage mechanisms, the currently available implementations are 'cgit' and pure python, which is the default.Documentation The latest documentation can be found here: As this version of GitPython depends on GitDB, which in turn needs smmap to work, installation is a bit more involved if you do a manual installation, instead of using pip.

Security Fix(es):

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.(CVE-2026-87817)

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.(CVE-2026-87818)

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.(CVE-2026-87819)

**GitPython*is a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files support.With the new object database abstraction added in 0.3, its even possible to implement your own storage mechanisms, the currently available implementations are 'cgit' and pure python, which is the default.Documentation The latest documentation can be found here: As this version of GitPython depends on GitDB, which in turn needs smmap to work, installation is a bit more involved if you do a manual installation, instead of using pip.

Security Fix(es):

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.(CVE-2026-87817)

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.(CVE-2026-87818)

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.(CVE-2026-87819)

**GitPython*is a python library used to interact with Git repositories.GitPython provides object model read and write access to your git repository. Access repository information conveniently, alter the index directly, handle remotes, or go down to low-level object database access with big-files support.With the new object database abstraction added in 0.3, its even possible to implement your own storage mechanisms, the currently available implementations are 'cgit' and pure python, which is the default.Documentation The latest documentation can be found here: As this version of GitPython depends on GitDB, which in turn needs smmap to work, installation is a bit more involved if you do a manual installation, instead of using pip.

Security Fix(es):

GitPython before 3.1.60 fails to properly validate the git directory location, allowing attackers to impersonate the git directory using tracked files like gitdir, commondir, and HEAD. Attackers can execute arbitrary code by placing a malicious pre-commit hook in the tracked hooks directory that executes when a victim calls index.commit() on a cloned or opened repository.(CVE-2026-87817)

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.(CVE-2026-87818)

GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated angle bracket to cause quadratic backtracking, exhausting CPU resources for over two minutes per commit access.(CVE-2026-87819)

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.

This update for python-GitPython fixes the following issues:

• CVE-2026-67322: environment-variable exfiltration in Repo.clone_from() URL via os.path.expandvars() (bsc#1273357).
• CVE-2026-67323: unguarded Git options passed as keyword arguments in Repo.archive() and git.ls_remote() allow for command injection (bsc#1273358).
• CVE-2026-67325: incomplete command injection blocklist fails to account for git's long-option prefix abbreviation feature and allows for bypass (bsc#1273359).
• CVE-2026-67326: failure to validate newline characters in the section parameter of config_writer() can lead to RCE via core.hooksPath (bsc#1273364).
• CVE-2026-69097: failure to properly escape section names in Git config files allows for injection of arbitrary configuration directives through malicious submodule names and can lead to RCE (bsc#1273414).
• CVE-2026-73619: incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add- virtual-file options can lead to arbitrary file reads (bsc#1275755).
• CVE-2026-73620: failure to guard Git option forwarding in IndexFile.checkout() and TagReference.create() can lead to arbitrary file reads and writes (bsc#1275756).
• CVE-2026-73621: argument injection in the Commit.count() method allows for destruction/blanking of arbitrary files (bsc#1275757).
• CVE-2026-73622: failure to disable environment variable expansion in Remote.create() and Submodule.add() URL handling allows for secret exfiltration via URLs containing variable references (bsc#1275751).
• CVE-2026-73623: incomplete denylist in unsafe_git_clone_options that omits --template allows for arbitrary command execution (bsc#1275752).
• CVE-2026-73624: Diffable.diff method fails to validate git options passed through kwargs, which can lead to arbitrary file writes (bsc#1275753).
• CVE-2026-73625: check_unsafe_options guard bypass via smuggling of git options inside single-character kwarg values can lead to arbitrary code execution (bsc#1275754).
• CVE-2026-76217: failure to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout() can lead to arbitrary file reads (bsc#1275745).
• CVE-2026-76218: unguarded git option forwarding in Repo.init allows for arbitrary command execution (bsc#1275746).
• CVE-2026-76219: unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree can lead to arbitrary file overwrites (bsc#1275747).
• CVE-2026-76220: check_unsafe_options guard can be bypassed by combining a single-character kwarg with split_single_char_options=False, which can lead to arbitrary OS command injection (bsc#1275748).
• CVE-2026-76221: config-name injection in the option-name validator can lead to remote code execution (bsc#1275749).
• CVE-2026-76222: failure to validate submodule names from .gitmodules files allows creation of Git repositories at arbitrary filesystem paths outside the intended clone directory (bsc#1275750).
• CVE-2026-78675: failure to disable merge_includes when parsing .gitmodules can lead to discloseure of local file contents when arbitrary file paths are included via [include] directives (bsc#1276434).
• CVE-2026-78676: failure to safely re-serialize multi-line git-config values during write operations can corrupt dormant quoted values into live injected directives (bsc#1276433).
• CVE-2026-78677: omission of --separate-git-dir from unsafe_git_clone_options allows for creation of arbitrary git directories outside the intended clone destination (bsc#1276432).
• CVE-2026-78678: incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options allows for reading of arbitrary files when these options to are passed to Repo.blame() (bsc#1276431).
• CVE-2026-78679: positional reference parameter can bypass an unsafe option guard and allows for arbitrary file read via…

This update for python-GitPython fixes the following issues:

• CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the git directory using tracked files and execute arbitrary code by placing pre-commit hooks in the tracked hooks directory (bsc#1279905).
• CVE-2026-87818: failure to restrict the --no-index option in the high-level diff API allows attackers to read arbitrary filesystem paths as repository operands and create content-dependent Boolean oracles (bsc#1279906).
• CVE-2026-87819: quadratic backtracking in the Actor.name_email_regex regular expression allows attackers to cause CPU exhaustion and a DoS via a commit with a malformed author field (bsc#1279907).