https://vulnerability.circl.lu/sightings/feed 2026-09-18T23:50:39.917301+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/f105d038-b89f-4b43-a9f8-5d09b342b967/export 2026-09-18T23:50:39.940435+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "f105d038-b89f-4b43-a9f8-5d09b342b967", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78679", "type": "seen", "source": "https://gist.github.com/alon710/203f3e8540b97026337742aaf8fa0eb2", "content": "# CVE-2026-78679: CVE-2026-78679: Arbitrary File Read via Command-Line Option Injection in GitPython\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-78679\n\n## Summary\nA command-line option injection vulnerability in GitPython allows low-privilege or unauthenticated actors to read arbitrary local files. The flaw resides in the TagReference.create() function, which fails to evaluate positional arguments against the library's unsafe-option denylist, enabling the execution of native git commands with injected option flags.\n\n## TL;DR\nGitPython prior to version 3.1.59 fails to validate positional parameters in TagReference.create(), enabling command-line option injection (like --file) that allows attackers to perform arbitrary file reads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-73\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.1\n- **EPSS Score**: 0.00241\n- **Impact**: Arbitrary File Read / Information Disclosure\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications incorporating GitPython versions 3.1.33 through 3.1.58 that allow user control over TagReference positional parameters.\n- **GitPython**: >= 3.1.33, < 3.1.59 (Fixed in: `3.1.59`)\n\n## Mitigation\n\n- Upgrade GitPython to version 3.1.59 or higher to receive the official security patch.\n- Implement strict input validation on all parameters passed to GitPython to ensure no string starts with a hyphen.\n- Implement least-privilege permissions on the host system to minimize the impact of file read operations.\n\n**Remediation Steps:**\n1. Identify all projects and environments containing GitPython prior to version 3.1.59.\n2. Update requirements.txt, setup.py, or Pipfile to specify gitpython>=3.1.59.\n3. Run 'pip install --upgrade gitpython' to install the updated library.\n4. Verify that the TagReference.create() call blocks hyphenated values by running validation test cases.\n\n## References\n\n- [GitHub Security Advisory GHSA-3wxw-xv34-2frg](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg)\n- [CVE.org CVE Record - CVE-2026-78679](https://www.cve.org/CVERecord?id=CVE-2026-78679)\n- [GitPython v3.1.59 Release](https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59)\n- [NVD - CVE-2026-78679](https://nvd.nist.gov/vuln/detail/CVE-2026-78679)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-78679) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-08T21:28:14.013814Z"} 2026-09-08T21:28:14.013814+00:00 https://vulnerability.circl.lu/sighting/b642deb5-68a3-4ce2-b4d5-648377b75e21/export 2026-09-18T23:50:39.942400+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "b642deb5-68a3-4ce2-b4d5-648377b75e21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-78675", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-7833-fr7j-v32q", "content": "", "creation_timestamp": "2026-09-08T20:35:14.923533Z"} 2026-09-08T20:35:14.923533+00:00 https://vulnerability.circl.lu/sighting/894c5566-5dd2-4e16-a335-03f63b1084fc/export 2026-09-18T23:50:39.943310+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "894c5566-5dd2-4e16-a335-03f63b1084fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-78676", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-284h-m62q-gf8w", "content": "", "creation_timestamp": "2026-09-08T20:35:09.382222Z"} 2026-09-08T20:35:09.382222+00:00 https://vulnerability.circl.lu/sighting/cf0947ad-a57a-4289-aaec-e35f28a5660a/export 2026-09-18T23:50:39.943418+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "cf0947ad-a57a-4289-aaec-e35f28a5660a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-78678", "type": "published-proof-of-concept", "source": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287", "content": "", "creation_timestamp": "2026-09-08T20:35:07.164565Z"} 2026-09-08T20:35:07.164565+00:00 https://vulnerability.circl.lu/sighting/4c1cfdbf-18f2-4fe9-9c92-9b2b1569b6f8/export 2026-09-18T23:50:39.943491+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "4c1cfdbf-18f2-4fe9-9c92-9b2b1569b6f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-78677", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-8mcc-hrx5-hvxc", "content": "", "creation_timestamp": "2026-09-08T20:35:04.923437Z"} 2026-09-08T20:35:04.923437+00:00 https://vulnerability.circl.lu/sighting/3c6b193f-d6c4-4515-be9e-c105023676e6/export 2026-09-18T23:50:39.943566+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "3c6b193f-d6c4-4515-be9e-c105023676e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-78679", "type": "published-proof-of-concept", "source": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg", "content": "", "creation_timestamp": "2026-09-08T20:35:02.638486Z"} 2026-09-08T20:35:02.638486+00:00 https://vulnerability.circl.lu/sighting/3622433b-8e1b-4b99-806c-197cdb0e5a04/export 2026-09-18T23:50:39.943637+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "3622433b-8e1b-4b99-806c-197cdb0e5a04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtzvttsqr724", "content": "CVE-2026-78676 - python-git\nIf you use GitPython versions older than 3.1.59, a specially crafted Git configuration file can be rewritten incorrectly, turning harmless text into a new setting that\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#pythongit #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-08-27T03:30:04.920653Z"} 2026-08-27T03:30:04.920653+00:00 https://vulnerability.circl.lu/sighting/7d6b2062-c87b-4965-951f-7fd7af79645d/export 2026-09-18T23:50:39.943712+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7d6b2062-c87b-4965-951f-7fd7af79645d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtvfofvooj23", "content": "CVE-2026-78676\nIf your applications use the GitPython library version older than 3.1.59, a specially crafted Git configuration file can cause the library to insert harmful commands when it saves settings. This can lead to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-25T08:30:04.366898Z"} 2026-08-25T08:30:04.366898+00:00 https://vulnerability.circl.lu/sighting/7adc0894-41b5-4f43-b8de-c26ea2dc273c/export 2026-09-18T23:50:39.943783+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7adc0894-41b5-4f43-b8de-c26ea2dc273c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtv23srsqy2n", "content": "Daily IT Security Digest \u2014 2026-08-25\n[@stemshop.bsky.social](https://stemshop.top/cve/CVE-2026-78676)]\n\n## 2. Critical Sandbox Escape in `isolated-vm` Library \u2014 Remote Code Execution via Type Confusion\n\nA critical type confusion vulnerability in the `isolated-vm` JavaScript sandbox library allows", "creation_timestamp": "2026-08-25T05:02:48.254951Z"} 2026-08-25T05:02:48.254951+00:00 https://vulnerability.circl.lu/sighting/851d8c01-2bda-46b7-a98c-f01e2b39e6e2/export 2026-09-18T23:50:39.943856+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "851d8c01-2bda-46b7-a98c-f01e2b39e6e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtv23rwqqz2b", "content": "Daily IT Security Digest \u2014 2026-08-25\n# Daily IT Security Digest \u2014 2026-08-25\n\n## 1. Critically Vulnerable GitPython (CVE-2026-78676) \u2014 Arbitrary Code Execution via Malicious .gitconfig\n\nA critical argument injection flaw (CVSS 9.3) exists in GitPython versions below 3.1.59. Multi-line git-config", "creation_timestamp": "2026-08-25T05:02:47.703673Z"} 2026-08-25T05:02:47.703673+00:00