CVE-2026-78679: External Control of File Name or Path in gitpython-developers GitPython

The vulnerability arises because TagReference.create() forwards a caller-influenced positional 'reference' argument directly to the 'git tag' command without proper inspection by the unsafe-option guard. The prior fix added a denylist for unsafe options like '--file' but only checked keyword arguments, ignoring positional arguments. An attacker can supply '--file=<path>' as the positional 'reference' argument, causing 'git tag' to create an annotated tag whose message contains the contents of the specified local file. This leads to an arbitrary local file read at the privileges of the host process. The issue affects GitPython versions before 3.1.59, as the sink remains unchanged in the latest release. The suggested fix is to include positional arguments in the unsafe option checks or to separate positional arguments with '--' to prevent option injection.

Allows an attacker with the ability to control the 'reference' positional argument in TagReference.create() to read arbitrary local files on the host system. The file contents are returned in-band as the annotated tag message. This could expose sensitive files such as private keys or configuration files. The attack requires the embedding application to pass user-controlled input to this function, and the process privileges determine the scope of accessible files.

No official fix is currently published. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a workaround, avoid passing user-controlled input directly to the 'reference' positional argument of TagReference.create(). The suggested fix is to modify GitPython to include positional arguments in the unsafe option checks or to insert a '--' separator before positional arguments in TagReference.create() to prevent option injection.