CVE-2026-78675: External Control of File Name or Path in gitpython-developers GitPython

GitPython versions prior to 3.1.59 have a vulnerability in the submodule configuration parser (`Submodule._config_parser()`) where the `merge_includes` option is enabled by default. This allows an attacker controlling the `.gitmodules` file in a cloned repository to specify an `[include]` directive pointing to arbitrary local files (absolute or relative paths). The parser reads these files without containment checks, and if the included file is not a valid git config file, it raises a `MissingSectionHeaderError` exception. The exception message includes the first line of the included file verbatim, causing local file content disclosure. This occurs during common read-only operations such as enumerating submodules (`repo.submodules`), requiring no submodule update or checkout. The root cause is a parity gap where the config parser used for writing disables `merge_includes`, but the one used for reading `.gitmodules` does not. This vulnerability has a CVSS 4.0 score of 8.6 (high severity).

An attacker who can supply a malicious `.gitmodules` file in a cloned repository can cause GitPython to disclose the first line of arbitrary local files on the victim's system. This occurs during normal read-only operations such as listing submodules, without requiring any write or update actions. The disclosed information appears in exception messages, which may be logged or displayed by applications using GitPython, potentially leaking sensitive information such as system configuration or credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted repositories with GitPython versions prior to 3.1.59, or modify the code to disable `merge_includes` when parsing `.gitmodules`. Monitor vendor communications for updates and apply official patches once released.