CVE-2026-87818

GitPython 3.1.59 Local File Content Oracle via --no-index

No known exploitation. EPSS puts it in the 33rd percentile. A vendor fix is available.

CVSS 3.16.5Medium EPSS percentile33rd0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-09Updated 2026-09-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your application uses gitpython version 3.1.59 and allows untrusted users to influence diff requests.
Upgrade gitpython to version 3.1.60.
Until upgraded, prevent users from supplying options or file paths to the high-level diff feature.

pip install GitPython==3.1.60

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.

In plain language

Written by AI from the record

If you use gitpython version 3.1.59, a logged-in attacker may be able to infer secrets stored on the server; update to 3.1.60.

GitPython 3.1.59 permits argument injection into its high-level diff API: `--no-index` can be combined with ignore-pattern options to create a content-dependent local-file oracle.

If you're affected

Server secret exposure
Configuration data disclosure
Source-code disclosure
Privacy incident

What is it

This is a flaw in a tool developers use to compare file changes. It can act like someone repeatedly trying a locked filing cabinet and learning what is inside from the different sounds the lock makes, potentially revealing secrets without directly opening the file.

Who is affected

This matters to you if you run an application that uses gitpython version 3.1.59. It is a risk when an attacker with access to the application can influence requests sent to its high-level diff feature.

How urgent is it

An attacker would need access to an application path that lets them control diff requests, but successful abuse could expose sensitive files on the server. No known public exploit code exists and CISA has not listed this issue as actively exploited, so treat this as an amber-priority update and schedule the upgrade promptly.

What to do — in detail

Confirm the installed version with your dependency-management tooling and review whether any application endpoint passes user-controlled options or paths into GitPython's high-level diff API.

Upgrade to GitPython 3.1.60; no alternative fixed branch is provided in the findings. Test normal repository comparison workflows after upgrading, as the fix blocks unsafe handling of --no-index.

If patching is delayed, remove or tightly validate user control over diff options and file paths, specifically rejecting --no-index, -I, and --ignore-matching-lines before they reach the API. Review application error events and requests involving the diff feature for unusual repeated comparisons or attempts to reference system file paths. CISA has not assigned a KEV remediation due date.

Technical context

CVE-2026-87818 is rated CVSS 6.5 (Medium) with CWE-88. GitPython 3.1.59 fails to restrict --no-index in its high-level diff API, enabling repository-operand manipulation; combined with -I/--ignore-matching-lines, response differences can form a Boolean oracle for local-file content. The attack vector is network-accessible in the CVSS assessment, requires low privileges, and does not require user interaction. EPSS is 0.2% (16th percentile) and flat. It is not in CISA KEV, and no public exploit code is on record.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS33rd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 33rd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 9 days, from the signal feeds we watch.

2026-09-18OpenVAS check added
2026-09-16Patch availablerecord updated
2026-09-09Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

gitpython projectoss-projectaka gitpython
- gitpythonLibraryOSS Libraries / pypi
gitpython-developerspackage-ecosystem
- GitPythonMixedDevTools & CI / source-control

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Scored 6.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact