THREAT OPS › Threat News › [GHSA] GHSA-3wxw-xv34-2frg (medium) — GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)
[GHSA] GHSA-3wxw-xv34-2frg (medium) — GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)
GHSA-3wxw-xv34-2frg Severity: medium CVE: CVE-2026-78679
GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)
## Summary `TagReference.create()` forwards a caller-influenced positional `reference` value into `git tag` without it ever being inspected by the unsafe-option guard, allowing an arbitrary file r
Indicators of compromise
- CVE-2026-78679cve
- CVE-2026-42215cve
Original source: https://github.com/advisories/GHSA-3wxw-xv34-2frg