{"action":"Upgrade gitpython to 3.1.59 or later.","affected":[{"fixed":"3.1.59","introduced":"0"}],"component":"gitpython","cve_ids":["CVE-2026-78675"],"ecosystem":"PyPI","epss":0.00178,"exploited":false,"fixed_versions":["3.1.59"],"ghsa_id":"GHSA-7833-fr7j-v32q","id":"tcs_01M5KF5BK34CE94RWRVH17Z8T3","modified_at":"2026-09-23T05:15:05.931147061Z","published_at":"2026-09-08T18:38:51Z","references":["https://osv.dev/vulnerability/GHSA-7833-fr7j-v32q","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q","https://nvd.nist.gov/vuln/detail/CVE-2026-78675","https://github.com/gitpython-developers/GitPython/pull/2211","https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c","https://github.com/gitpython-developers/GitPython","https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59","https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3785.yaml","https://www.vulncheck.com/advisories/gitpython-before-local-file-content-disclosure-via-gitmodules"],"severity":{"label":"high","score":8.4},"sources":[{"source":"osv","source_id":"GHSA-7833-fr7j-v32q","url":"https://osv.dev/vulnerability/GHSA-7833-fr7j-v32q"}],"summary":"GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)"}