Skip to content
Heist/ feed
Unrated

Duplicate Advisory: GitPython 3.1.59: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

Type: withdrawalSource: OSV1 source record

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-whh4-5q6c-9v3x. This link is maintained to preserve external references. ## Original Description GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.

Announced Source revision 1
Original source ↗

GHSA-rw58-wc66-99g4

Primary source · Revision 1 · Withdrawn

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-rw58-wc66-99g4

gitpython

Source reference: /affected/0/package/name

Affected versions
3.1.59

Source reference: /affected/0/versions

3.1.60

Source reference: /affected/0/versions

3.1.61

Source reference: /affected/0/versions

3.1.62

Source reference: /affected/0/versions

3.2.0

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "3.1.59"
          }
        ]
      }
    ],
    "package": {
      "name": "gitpython",
      "purl": "pkg:pypi/gitpython",
      "ecosystem": "PyPI"
    },
    "versions": [
      "3.1.59",
      "3.1.60",
      "3.1.61",
      "3.1.62",
      "3.2.0"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-rw58-wc66-99g4/GHSA-rw58-wc66-99g4.json",
      "last_known_affected_version_range": "< 3.1.60"
    }
  }
]
Related CVEs
CVE-2026-87818

Source reference: /aliases

Publisher severity

high

Source reference: /database_specific/severity

Event
#51908 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement