THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-7833-fr7j-v32q (high) — GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

[GHSA] GHSA-7833-fr7j-v32q (high) — GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

highgithub_advisoriesPublished 2026-09-08

GHSA-7833-fr7j-v32q Severity: high CVE: CVE-2026-78675

GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)

# [HIGH] Arbitrary local file content disclosure via `[include]` directive in untrusted `.gitmodules` (`SubmoduleConfigParser` never disables `merge_includes`)

- **CWE:** CWE-200 (Exposure

Indicators of compromise

9729ed3b948f2bde09f1f188c5311e172212b67esha1
CVE-2026-78675cve

Original source: https://github.com/advisories/GHSA-7833-fr7j-v32q