This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-87818 →

DEBIAN-CVE-2026-87818

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as reposito...

Original description

The description as published by the source.

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 python-git

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.61-1"}]}]

References

advisory security-tracker.debian.org