{"vulnerability": "CVE-2026-7867", "sightings": [{"uuid": "697c18e1-46ab-4395-ac84-4eb6c103d58f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78679", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/iblly34rmrd7h", "content": "CVE-2026-78679 - GitPython before 3.1.59 Arbitrary File Read via TagReference.create\nCVE ID : CVE-2026-78679\n \n Published : Aug. 25, 2026, 1:30 a.m. | 34\u00a0minutes ago\n \n Description : GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create()...", "creation_timestamp": "2026-08-25T02:14:29.643935Z"}, {"uuid": "4efaaf49-dbb1-4ebb-ac39-00149a4803d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtuqyskh5o2y", "content": "CVE-2026-78676 - gitpython\nIf you use GitPython version 3.1.58 or older, specially crafted configuration files can be changed when the software writes its settings, turning harmless text into\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitpython #gitpythondevelopers #CVE #infosec", "creation_timestamp": "2026-08-25T02:20:04.191740Z"}, {"uuid": "b4844971-3bc2-4f37-b82e-b64efc1c5b35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78676", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117153911650352822", "content": "CVE-2026-78676 | GitPython <3.1.59 has a CRITICAL argument injection flaw: multi-line git-config values can become active directives, enabling arbitrary code execution via git hooks. Patch status unknown \u2014 avoid untrusted configs. https://radar.offseq.com/threat/cve-2026-78676-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-in-98aef85f24190fbe #OffSeq #CVE202678676 #git #infosec", "creation_timestamp": "2026-08-25T03:00:26.436451Z"}, {"uuid": "4a384346-60da-419d-b321-93ad9c6ddd5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78676", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtutb2i47z2w", "content": "GitPython <3.1.59 faces CRITICAL argument injection (CVE-2026-78676): attackers can execute arbitrary code via crafted git config files. Avoid untrusted configs until a patch is confirmed. https://radar.offseq.com/threat/cve-2026-78676-improper-neutralization-of-argument-delimiters-in-a-command-a...", "creation_timestamp": "2026-08-25T03:00:28.619399Z"}, {"uuid": "68f4faf4-78e9-47ce-910b-d159f27f5276", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtux2buv5a2y", "content": "\ud83d\udea8 CVE-2026-78676 \u2014 CVSS 9.3 CRITICAL\n\nGitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-78676\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-25T04:08:15.970841Z"}, {"uuid": "851d8c01-2bda-46b7-a98c-f01e2b39e6e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtv23rwqqz2b", "content": "Daily IT Security Digest \u2014 2026-08-25\n# Daily IT Security Digest \u2014 2026-08-25\n\n## 1. Critically Vulnerable GitPython (CVE-2026-78676) \u2014 Arbitrary Code Execution via Malicious .gitconfig\n\nA critical argument injection flaw (CVSS 9.3) exists in GitPython versions below 3.1.59. Multi-line git-config", "creation_timestamp": "2026-08-25T05:02:47.703673Z"}, {"uuid": "7adc0894-41b5-4f43-b8de-c26ea2dc273c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtv23srsqy2n", "content": "Daily IT Security Digest \u2014 2026-08-25\n[@stemshop.bsky.social](https://stemshop.top/cve/CVE-2026-78676)]\n\n## 2. Critical Sandbox Escape in `isolated-vm` Library \u2014 Remote Code Execution via Type Confusion\n\nA critical type confusion vulnerability in the `isolated-vm` JavaScript sandbox library allows", "creation_timestamp": "2026-08-25T05:02:48.254951Z"}, {"uuid": "3622433b-8e1b-4b99-806c-197cdb0e5a04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtzvttsqr724", "content": "CVE-2026-78676 - python-git\nIf you use GitPython versions older than 3.1.59, a specially crafted Git configuration file can be rewritten incorrectly, turning harmless text into a new setting that\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#pythongit #debian #Debian11 #CVE #infosec", "creation_timestamp": "2026-08-27T03:30:04.920653Z"}, {"uuid": "7d6b2062-c87b-4965-951f-7fd7af79645d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtvfofvooj23", "content": "CVE-2026-78676\nIf your applications use the GitPython library version older than 3.1.59, a specially crafted Git configuration file can cause the library to insert harmful commands when it saves settings. This can lead to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-25T08:30:04.366898Z"}, {"uuid": "3c6b193f-d6c4-4515-be9e-c105023676e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-78679", "type": "published-proof-of-concept", "source": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg", "content": "", "creation_timestamp": "2026-09-08T20:35:02.638486Z"}, {"uuid": "4c1cfdbf-18f2-4fe9-9c92-9b2b1569b6f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-78677", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-8mcc-hrx5-hvxc", "content": "", "creation_timestamp": "2026-09-08T20:35:04.923437Z"}, {"uuid": "cf0947ad-a57a-4289-aaec-e35f28a5660a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-78678", "type": "published-proof-of-concept", "source": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287", "content": "", "creation_timestamp": "2026-09-08T20:35:07.164565Z"}, {"uuid": "894c5566-5dd2-4e16-a335-03f63b1084fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-78676", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-284h-m62q-gf8w", "content": "", "creation_timestamp": "2026-09-08T20:35:09.382222Z"}, {"uuid": "b642deb5-68a3-4ce2-b4d5-648377b75e21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-78675", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-7833-fr7j-v32q", "content": "", "creation_timestamp": "2026-09-08T20:35:14.923533Z"}, {"uuid": "f105d038-b89f-4b43-a9f8-5d09b342b967", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78679", "type": "seen", "source": "https://gist.github.com/alon710/203f3e8540b97026337742aaf8fa0eb2", "content": "# CVE-2026-78679: CVE-2026-78679: Arbitrary File Read via Command-Line Option Injection in GitPython\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-78679\n\n## Summary\nA command-line option injection vulnerability in GitPython allows low-privilege or unauthenticated actors to read arbitrary local files. The flaw resides in the TagReference.create() function, which fails to evaluate positional arguments against the library's unsafe-option denylist, enabling the execution of native git commands with injected option flags.\n\n## TL;DR\nGitPython prior to version 3.1.59 fails to validate positional parameters in TagReference.create(), enabling command-line option injection (like --file) that allows attackers to perform arbitrary file reads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-73\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 7.1\n- **EPSS Score**: 0.00241\n- **Impact**: Arbitrary File Read / Information Disclosure\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications incorporating GitPython versions 3.1.33 through 3.1.58 that allow user control over TagReference positional parameters.\n- **GitPython**: >= 3.1.33, < 3.1.59 (Fixed in: `3.1.59`)\n\n## Mitigation\n\n- Upgrade GitPython to version 3.1.59 or higher to receive the official security patch.\n- Implement strict input validation on all parameters passed to GitPython to ensure no string starts with a hyphen.\n- Implement least-privilege permissions on the host system to minimize the impact of file read operations.\n\n**Remediation Steps:**\n1. Identify all projects and environments containing GitPython prior to version 3.1.59.\n2. Update requirements.txt, setup.py, or Pipfile to specify gitpython>=3.1.59.\n3. Run 'pip install --upgrade gitpython' to install the updated library.\n4. Verify that the TagReference.create() call blocks hyphenated values by running validation test cases.\n\n## References\n\n- [GitHub Security Advisory GHSA-3wxw-xv34-2frg](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg)\n- [CVE.org CVE Record - CVE-2026-78679](https://www.cve.org/CVERecord?id=CVE-2026-78679)\n- [GitPython v3.1.59 Release](https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59)\n- [NVD - CVE-2026-78679](https://nvd.nist.gov/vuln/detail/CVE-2026-78679)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-78679) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-08T21:28:14.013814Z"}]}