CVE-2026-87818 GitPython 3.1.59 Local File Content Oracle via --no-index
Attackers can read arbitrary local files and recover secrets by exploiting the unrestricted --no-index option in GitPython's diff API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-87818?
CVE-2026-87818 is a high-severity vulnerability in gitpython-developers GitPython, published on 9 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.
Weakness: CWE-88
Which versions are affected by CVE-2026-87818?
2 open source packages ship an affected version, including gitpython. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gitpython PyPI | From 3.1.59 | 3.1.60 |
gitpython PyPI | From 3.1.59 | 3.1.60 |
Products include Gitpython Project Gitpython.
How do I fix CVE-2026-87818?
Upgrade gitpython to 3.1.60 or later.
Is CVE-2026-87818 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-87818 exists.
Other vulnerabilities in gitpython-developers GitPython
- CVE-2023-40267 GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
- CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection
- CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options
- CVE-2026-42215 GitPython: Command injection via Git options bypass
- CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
Sources
Also known as DEBIAN-CVE-2026-87818, ECHO-bdbc-88ca-0cc5, ECHO-bdd7-5c4c-a5b5, GHSA-whh4-5q6c-9v3x, MINI-24xm-wpqq-gjwj, MINI-fp43-xcgw-j93h and 2 more.