legit

GitPython versions up to 1.2.0.post0_15 contain a vulnerability in the TagReference.create() method where a positional 'reference' argument can bypass the unsafe option guard for '--file'. This allows an attacker controlling the 'reference' parameter to cause an arbitrary local file read, with the file contents returned as the annotated tag message. The issue is an incomplete fix of a prior vulnerability and requires the embedding application to forward a user-controlled 'reference' value. A fix is available in version 1.2.0.post0_15.

GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read…

snowflake-cli

## Summary
`TagReference.create()` forwards a caller-influenced positional `reference` value into `git tag` without it ever being inspected by the unsafe-option guard, allowing an arbitrary file read (the file's contents are returned in-band as the annotated tag message). This is an incomplete-fix bypass of commit `3af0c251` (the fix for GHSA-3f7w-8rr8-f37f's tag instance).

## Root Cause
The fix `3af0c251` added `unsafe_git_tag_options = ["--file","-F"]` and a guard call, but the guard is `Git.check_unsafe_options(options=Git._option_candidates([], kwargs), unsafe_options=...)` at `git/refs/tag.py:139` — it passes an EMPTY args list and inspects **kwargs only**. The dangerous values `path` and `reference` are POSITIONALS (`args = (path, reference)`, tag.py:156), placed before any `--`. A user-influenced `reference="--file=<path>"` therefore reaches `git tag` as the exact `--file` option the fix intended to block, creating an annotated tag whose message is the file's contents.

## Impact
Arbitrary local file read at the privileges of the host process; contents returned in-band via `tagref.tag.message`. Requires the embedding application to forward a caller-influenced `reference` value into `TagReference.create()` (pure VALUE control — the CVE-2026-42215 threat model). Default `allow_unsafe_options=False`.

## Proof of Concept
```python
from git import TagReference
t = TagReference.create(repo, "vpwn", reference="--file=/home/app/.ssh/id_rsa")
print(t.tag.message)   # contents of the file
```

## Attack Chain
1. Entry: app calls `TagReference.create(repo, name, reference=<user>)` with `reference="--file=/home/app/.ssh/id_rsa"`.
2. Check: `Git.check_unsafe_options(_option_candidates([], kwargs), ["--file","-F"])` @ tag.py:137-141. Guard: denylist includes `--file`/`-F`. Bypass proof: `_option_candidates` receives `args=[]` → the positional `reference` is never a candidate (the kwarg spelling `file="…"` IS blocked; only the positional escapes).
3. Sink: `repo.git.tag(*args, **kwargs)` @ tag.py:158 → no `--`. argv (observed): `['git','tag','-f','vpwn','--file=<secret>']`.
4. Impact: annotated tag created; `tagref.tag.message` == file contents (arbitrary file read).

## Bypass Evidence
Independently reproduced (independent test harness, git 2.43.0, default `allow_unsafe_options=False`): `TagReference.create(repo,'vp','--file=<secret>')` → PASSED; `tag.message == 'GATE_SECRET_LINE_A\nGATE_SECRET_LINE_B'`. Control: `TagReference.create(..., file='<secret>')` → `UnsafeOptionError: --file is not allowed`. Fix-commit read: `3af0c251` adds `_option_candidates([], kwargs)` (empty args → positional never a candidate).

## Affected Versions
`GitPython <= 3.1.58` (sink present verbatim on the latest release tag; `git diff 3.1.57..HEAD` touches only test files).

## Suggested Fix
Include the positional `reference` (and `path`) in the option-candidate list passed to `check_unsafe_options`, or place a `--` separator before the positional arguments in `TagReference.create()`.

---
Reported by **zx (Jace)** — GitHub: @manus-use

snakemake

GitPython versions up to 3.1.58 contain a vulnerability in TagReference.create() where a positional argument 'reference' can bypass the unsafe option guard for '--file', allowing an attacker to read arbitrary local files. This occurs because the guard only inspects keyword arguments, not positional ones, enabling injection of '--file=<path>' as a positional argument. The file contents are returned in the annotated tag message. The issue is fixed in version 9.25.2.

shallow-backup

nbdime

GitPython versions up to 3.1.58 contain a vulnerability in the TagReference.create() method where a positional 'reference' argument can bypass the unsafe option guard for '--file', allowing an attacker to read arbitrary local files. This occurs because the guard only inspects keyword arguments, not positional ones, enabling an attacker to supply '--file=<path>' as a positional reference. The file contents are returned in the annotated tag message. A fix is available in version 4.0.4_8.

cruft

GitPython's TagReference.create() method improperly handles a positional 'reference' argument, allowing an attacker to bypass unsafe option guards and cause an arbitrary local file read. This occurs because the unsafe option check only inspects keyword arguments, ignoring positional arguments that can inject '--file=<path>' into the git tag command. The file contents are returned in the annotated tag message. This vulnerability affects GitPython versions up to 3.1.58 and is fixed in version 2.16.0_15.

cf2tf

gitpython

GitPython versions before 3.1.59 contain an arbitrary file read vulnerability in the TagReference.create() function. This flaw allows attackers to bypass an unsafe option guard by supplying a specially crafted positional reference parameter, such as --file=<path>, enabling them to read arbitrary files. The contents of these files are returned in the annotated tag message. The vulnerability has a high severity with a CVSS score of 7.1.

Search: CVE-2026-78679