CVE-2026-78679 is an arbitrary file read vulnerability in GitPython before version 3.1.59. The flaw exists in the TagReference.create() method, where a positional reference parameter bypasses the unsafe option guard. This allows an attacker to supply a reference value like --file=<path>, which causes the application to read arbitrary files and include their contents in the annotated tag message output. This vulnerability has a CVSS 4.0 score of 7.1, indicating high severity, with network attack vector, low attack complexity, and no privileges or user interaction required.

An attacker with low privileges can remotely exploit this vulnerability to read arbitrary files on the system where GitPython is running. The file contents are exposed in the annotated tag message, potentially leaking sensitive information. There is no indication of privilege escalation or code execution from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, avoid using vulnerable versions of GitPython in untrusted environments or restrict access to trusted users only.