CVE-2026-87818: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in gitpython-developers GitPython
Affects gitpython-developers GitPythonSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 34% of CVEs
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| gitpython-developersGitPython | Affected
| Fixed in
|
PyPIgitpythonpkg:pypi/gitpythonOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until an official fix is released, avoid using GitPython 3.1.59 in untrusted environments or restrict access to trusted users only. Monitor vendor channels for updates addressing this vulnerability.
Description
GitPython version 3.1.59 contains a vulnerability in its high-level diff API where the --no-index option is not properly restricted. This flaw allows attackers with limited privileges to read arbitrary filesystem paths by using the --no-index option combined with the -I/--ignore-matching-lines flag. This can be exploited as a content-dependent Boolean oracle to extract single-line secrets from local files based on success or error responses.
Summary
CVE-2026-87818 describes an improper neutralization of argument delimiters (argument injection) vulnerability in GitPython 3.1.59. The issue arises because the --no-index option in the high-level diff API is not properly restricted, enabling attackers to specify arbitrary filesystem paths as repository operands. By combining --no-index with the -I/--ignore-matching-lines option, attackers can perform repeated queries on local files, effectively creating a content-dependent Boolean oracle. This allows them to infer the presence of secrets or sensitive information line-by-line based on the command's success or failure responses.
Impact
An attacker with local privileges can read arbitrary files on the filesystem by exploiting the unrestricted --no-index option. This can lead to disclosure of sensitive information such as secrets or credentials stored in local files. The vulnerability has a CVSS 4.0 base score of 7.1 (high severity), indicating significant impact on confidentiality without requiring user interaction or elevated privileges beyond local access.
References
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.