tach

## Summary
`Repo.blame()` / `Repo.blame_incremental()` guard forwarded revision options against `unsafe_git_revision_options`, but that denylist only contains the file-WRITE options `--output`/`-o`. `git blame` also honors `--contents <file>` and `-S <file>`, which cause the file's lines to be echoed into the blame result — an arbitrary file READ. Neither option is in the denylist, so a caller-influenced revision value of `--contents=<path>` passes the guard and leaks file contents. This is a distinct sink-option and impact class (READ) from GHSA-956x-8gvw-wg5v (which addressed the blame `--output` WRITE), directly analogous to GHSA-539m-9xh6-q6rr (archive READ gap accepted separately from the archive write/exec advisory).

## Root Cause
`unsafe_git_revision_options = ["--output","-o"]` (`git/repo/base.py:188`). The `rev` string is passed to `_option_candidates([rev], kwargs)` and placed BEFORE the `--` separator (base.py:841). The canonical name of `--contents=...` is `contents`, which is not on the denylist, so no `UnsafeOptionError` is raised. The trailing `--` protects only the pathspec, not the option before the revision.

## Impact
Arbitrary local file read at the privileges of the host process; the file's line contents appear in the blame result returned to the caller. Pure VALUE control (the caller forwards a user-influenced revision string). Default `allow_unsafe_options=False`.

## Proof of Concept
```python
result = repo.blame("--contents=/etc/passwd", "a.txt")
# result rows carry the victim file's line text
```

## Attack Chain
1. Entry: app calls `repo.blame(rev, file)` with attacker `rev="--contents=/etc/passwd"` (or kwarg `contents="/etc/passwd"`, or `-S`).
2. Check: `Git.check_unsafe_options(_option_candidates([rev,...], kwargs), unsafe_git_revision_options)` @ base.py:841. Guard: denylist = `["--output","-o"]` only. Bypass proof: canonical name `contents` ∉ denylist → no error.
3. Sink: `self.git.blame(rev, "--", file, p=True, ...)`. argv (observed): `['git','blame','-p','--contents=<secret>','HEAD','--','a.txt']`.
4. Impact: blame result rows carry the victim file's line text.

## Bypass Evidence
Independently reproduced (independent test harness, default `allow_unsafe_options=False`): `blame('--contents=<secret>','a.txt')` → guard PASSED; result rows = `['GATE_SECRET_LINE_A','GATE_SECRET_LINE_B']`. Control: `blame('--output=…')` still BLOCKED (guard active on this path). `-S` kwarg argv also reaches git unguarded.

## Affected Versions
`GitPython <= 3.1.58` (denylist present verbatim on the latest release tag).

## Suggested Fix
Prefer an allowlist of blame options; at minimum add `--contents`/`-S` (and any other path-taking blame options) to `unsafe_git_revision_options`, and make the membership rule "the option takes a filesystem path" rather than "the option writes output".

---
Reported by **zx (Jace)** — GitHub: @manus-use

GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via…

snowflake-cli

legit

kimi-cli

GitPython's Repo.blame() and Repo.blame_incremental() methods have an incomplete denylist for unsafe git revision options, omitting the --contents and -S options. This omission allows an attacker to cause arbitrary local file reads by passing these options, which echo file contents into the blame result. The vulnerability affects GitPython versions up to 3.1.58. A patch is available to address this issue by expanding the denylist to include these options.

snakemake

GitPython versions up to 3.1.58 have an incomplete denylist for unsafe git revision options in the Repo.blame() and Repo.blame_incremental() methods. The denylist blocks file-write options but omits the --contents and -S options, which allow reading arbitrary local files. An attacker controlling the revision argument can cause the blame result to include contents of arbitrary files accessible by the host process. This vulnerability allows local file read at the privileges of the application using GitPython.

shallow-backup

otterdog

opentimestamps-client

nbdime

GitPython versions up to 3.1.58 have an incomplete denylist for unsafe git revision options in the Repo.blame() and Repo.blame_incremental() methods. This flaw allows an attacker to use the --contents or -S options to read arbitrary local files by injecting these options into the revision parameter, bypassing the denylist which only blocks write-related options. The file contents are then included in the blame result returned to the caller, potentially exposing sensitive information. A fix is available in version 4.0.4_8.

mistral-vibe

GitPython versions before 2.26.0 have an incomplete denylist for unsafe git revision options in the Repo.blame() and Repo.blame_incremental() methods. This flaw allows an attacker to use the --contents or -S options to read arbitrary local files by causing the file's lines to be included in the blame output. The vulnerability arises because these read-related options are not included in the denylist, which only blocks write-related options like --output. This leads to arbitrary file read at the privileges of the host process without requiring user interaction.

GitPython versions prior to 1.2.0.post0_15 contain a vulnerability in the Repo.blame() and Repo.blame_incremental() methods where an incomplete denylist of unsafe git revision options allows arbitrary local file reads. Specifically, the options --contents and -S, which cause git blame to output the contents of a specified file, are not blocked, enabling an attacker to read arbitrary files on the host system with the privileges of the running process.

gitup

fdroidserver

cruft

GitPython versions up to 3.1.58 have an incomplete denylist for unsafe git revision options in the Repo.blame() and Repo.blame_incremental() methods. This allows an attacker to use the --contents or -S options to cause arbitrary local file reads, exposing file contents in the blame output. The vulnerability arises because the denylist only blocks file-write options (--output/-o) but omits these read-capable options. A fix is available in version 2.16.0_15.

conda-lock

cf2tf

gitpython

GitPython versions before 3.1.59 have a vulnerability due to an incomplete denylist in the unsafe_git_revision_options guard. This flaw allows attackers to bypass restrictions by using the --contents and -S options with the Repo.blame() method, enabling them to read arbitrary files. By supplying revision values such as --contents=/etc/passwd, attackers can leak file contents through the blame result returned to the caller.

Search: CVE-2026-78678