CVE-2026-87818

NameCVE-2026-87818
DescriptionGitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-4872-1, DSA-6594-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
python-git (PTS)bookworm3.1.30-1+deb12u2vulnerable
bookworm (security)3.1.30-1+deb12u3fixed
trixie3.1.44-1vulnerable
trixie (security)3.1.44-1+deb13u1fixed
forky, sid3.2.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
python-gitsourcebookworm3.1.30-1+deb12u3DLA-4872-1
python-gitsourcetrixie3.1.44-1+deb13u1DSA-6594-1
python-gitsource(unstable)3.1.61-1

Notes

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-whh4-5q6c-9v3x
Fixed by: https://github.com/gitpython-developers/GitPython/commit/09f2cf383a992d1af697364569e9f384748c1bd8 (3.1.60)
Search for package or bug name: Reporting problems