CVE-2026-78679: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-78679 is an arbitrary file read vulnerability in GitPython's TagReference.create() function affecting all versions before 3.1.59. The flaw allows an authenticated attacker to supply a crafted reference parameter (e.g., --file=<path>) that bypasses the unsafe option guard, causing the contents of arbitrary local files to be returned in the annotated tag message. It was published on August 25, 2026, and is classified as an incomplete fix of a prior vulnerability (GHSA-3f7w-8rr8-f37f / commit 3af0c251). The CVSS v3.1 base score is 6.5 (Medium), and the CVSS v4.0 base score is 7.1 (High) (GitHub Advisory, GitPython Advisory).

The root cause is classified as CWE-73 (External Control of File Name or Path) and CWE-88 (Improper Neutralization of Argument Delimiters). The prior fix for GHSA-3f7w-8rr8-f37f added a denylist guard (unsafe_git_tag_options = ["--file", "-F"]) in git/refs/tag.py, but the guard call passes an empty positional args list — Git.check_unsafe_options(options=Git._option_candidates([], kwargs), ...) — meaning only keyword arguments are inspected. Because reference is passed as a positional argument, a value like --file=/etc/passwd is never evaluated by the guard and flows directly into the git tag subprocess invocation without a -- separator. The embedding application must forward a caller-influenced reference value to TagReference.create() for exploitation to occur; a proof-of-concept is included in the official advisory (GitPython Advisory).

Successful exploitation allows any authenticated user with the ability to influence the reference parameter to read arbitrary files accessible to the host process (e.g., SSH private keys, application secrets, /etc/shadow), with file contents returned in-band via the annotated tag message. There is no integrity or availability impact; the vulnerability is purely a confidentiality breach. In multi-tenant or CI/CD environments where GitPython is used to process user-supplied tag references, this could lead to broad credential or secret exposure and facilitate lateral movement (GitPython Advisory, GitHub Advisory).

No public proof-of-concept exploit beyond the advisory's own demonstration code has been observed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (authenticated access) and no user interaction, making it straightforward for any user who can influence the reference argument passed to TagReference.create() (GitHub Advisory, VulnCheck Advisory).

1. Identify a target application: Locate a web application, CI/CD pipeline, or service that uses GitPython (< 3.1.59) and exposes an interface where a user can influence the reference parameter passed to TagReference.create().
2. Craft the malicious reference value: Prepare a reference string that encodes a --file= option pointing to a sensitive file, e.g., --file=/home/app/.ssh/id_rsa or --file=/etc/passwd.
3. Submit the payload: Trigger the application's tag creation functionality with the crafted reference value. For example, in Python: TagReference.create(repo, "vpwn", reference="--file=/home/app/.ssh/id_rsa").
4. Bypass the guard: Because reference is a positional argument, Git.check_unsafe_options receives an empty args list and does not flag the --file= option, allowing it to pass through to the git tag subprocess.
5. Retrieve file contents: Read the annotated tag message from the returned TagReference object: t.tag.message now contains the full contents of the targeted file, which may be returned to the attacker via the application's API response or logs (GitPython Advisory).

• Logs: Git command logs or application logs showing git tag invocations with --file= arguments pointing to sensitive paths (e.g., [git, tag, -f, <tagname>, --file=/etc/passwd]).
• File System: Unexpected annotated tags in repositories with messages containing file content (e.g., SSH keys, configuration files, or credential data) rather than normal commit messages.
• Process: Child processes of the application spawning git tag with --file=<sensitive_path> arguments visible in process listings or audit logs.
• Network: Outbound API responses or webhook payloads containing file content embedded in tag message fields, potentially indicating exfiltration via the application layer (GitPython Advisory).

Upgrade GitPython to version 3.1.59 or later, which includes the corrected fix that passes positional arguments (including reference) to the check_unsafe_options guard or inserts a -- separator before positional arguments in TagReference.create(). As a short-term workaround, restrict access to any application functionality that calls TagReference.create() with user-controlled input, and validate/sanitize the reference parameter to reject values beginning with - before passing them to GitPython (GitPython Advisory, GitHub Advisory).

The vulnerability was reported by researcher Jace (@manus-use) and published by the GitPython maintainers on August 10, 2026 (advisory GHSA-3wxw-xv34-2frg), with the CVE assigned on August 25, 2026. A threat intelligence digest noted this as part of a broader "mass disclosure" of five GitPython CVEs, suggesting a coordinated security review of the library (ThreatAft). No significant vendor statements or widespread social media discussion beyond standard vulnerability tracking have been observed.