UNKNOWN PyPI
CVE-2026-87818
PYSEC-2026-3983 · CVE-2026-87818 · GHSA-whh4-5q6c-9v3x
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.
Ready to move
Start Securing
Free, no credit card | First findings in minutes