THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-5xxx-qhh7-9287 (medium) — GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

[GHSA] GHSA-5xxx-qhh7-9287 (medium) — GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

medgithub_advisoriesPublished 2026-09-08

GHSA-5xxx-qhh7-9287 Severity: medium CVE: CVE-2026-78678

GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()

## Summary `Repo.blame()` / `Repo.blame_incremental()` guard forwarded revision options against `unsafe_git_revision_options`, but that denylist only contains the file-WRITE options `--output`/`-o`. `git blame` also

Indicators of compromise

CVE-2026-78678cve

Original source: https://github.com/advisories/GHSA-5xxx-qhh7-9287