CVE-2026-87818 describes an argument injection vulnerability in GitPython 3.1.59. The high-level diff API fails to restrict the --no-index option, which attackers can exploit to read arbitrary filesystem paths as repository operands. By combining this with the -I/--ignore-matching-lines option, attackers can perform repeated queries on local files, creating a content-dependent Boolean oracle that allows recovery of single-line secrets through distinguishable success or error responses. This vulnerability has a CVSS 4.0 score of 7.1, indicating high severity, and does not require user interaction or privileges beyond low-level privileges.

An attacker with low privileges can exploit this vulnerability remotely to read arbitrary files on the filesystem by abusing the --no-index option in the diff API. This can lead to disclosure of sensitive information such as secrets contained in local files. The vulnerability does not require user interaction and has a high impact on confidentiality (VC:H). There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using GitPython 3.1.59 in environments where untrusted users can invoke the diff API with the --no-index option. Monitor vendor communications for updates and apply official patches once released.