CVE-2026-87818— GitPython 3.1.59 Local File Content Oracle via --no-index
Quick assessment
Affected
gitpython-developers GitPython
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GitPython 3.1.59 未能限制高层 diff API 中的 选项，使得攻击者能够将任意文件系统路径作为仓库操作数进行读取。攻击者可以将 与 组合使用，构建一个基于内容的布尔预言机（Boolean oracle），通过反复查询本地文件，利用可区分的成功或错误响应来逐步恢复单行秘密信息。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87818
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GitPython 3.1.59 Local File Content Oracle via --no-index
Source: CVE Program / CVE List V5
Vulnerability Description
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| gitpython-developers | GitPython | 3.1.59 ~ 3.1.60 | - |
|
II. Public POCs for CVE-2026-87818
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87818
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-87818 (2)
-
-
🔗 GitPython 3.1.59 Local File Content Oracle via --no-index | Advisories | VulnCheck third-party-advisory
Same Patch Batch · gitpython-developers · 2026-09-09 · 3 CVEs total
| CVE-2026-87817 | 8.8 HIGH | GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation |
| CVE-2026-87819 | 7.5 HIGH | GitPython before 3.1.60 Denial of Service via ReDoS |
IV. Related Vulnerabilities
Same product: GitPython
-
CVE-2026-87819
GitPython before 3.1.60 Denial of Service via ReDoS -
CVE-2026-87817
GitPython before 3.1.60 Remote Code Execution via Git Direct -
CVE-2026-78679
GitPython before 3.1.59 Arbitrary File Read via TagReference -
CVE-2026-78678
GitPython before 3.1.59 Arbitrary File Read via Repo.blame() -
CVE-2026-78677
GitPython before 3.1.59 Path Traversal via separate-git-dir
Same vendor: gitpython-developers
-
CVE-2026-87819
GitPython before 3.1.60 Denial of Service via ReDoS -
CVE-2026-87817
GitPython before 3.1.60 Remote Code Execution via Git Direct -
CVE-2026-78679
GitPython before 3.1.59 Arbitrary File Read via TagReference -
CVE-2026-78678
GitPython before 3.1.59 Arbitrary File Read via Repo.blame() -
CVE-2026-78677
GitPython before 3.1.59 Path Traversal via separate-git-dir
Same weakness: CWE-88
-
CVE-2026-87794
bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zi -
CVE-2026-78635
Improper Input Validation in the Okta Privileged Access SSH -
CVE-2026-71377
Command Argument Injection Vulnerability in Cosminexus Compo -
CVE-2026-86060
SSH session privilege manipulation via a crafted username in -
CVE-2026-85626
git-mcp-server 2.15.1 Argument Injection via Git Ref Paramet
V. Comments for CVE-2026-87818
No comments yet