Veille CVE

Mardi 25 août 2026

2 CVE sur 5

Critique 1 Élevée 2 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « gitpython-developers GitPython » ✕
  1. CVE-2026-78679 6.5 Moyenne

    gitpython-developers GitPython

    GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.

  2. CVE-2026-78678 6.5 Moyenne

    gitpython-developers GitPython · Gitpython project gitpython

    GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.