CVE-2026-78678

Katalog CVE

CVSS 6.5 · Medium EPSS 0,41%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada gitpython project gitpython. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.

Rincian

Terbit di NVD

25 Agustus 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287 exploit · advisory vendor
• https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-blame advisory pihak ketiga