CVE-2026-87818: GitPython Local File Disclosure via --no-index Option
Summary
CVE-2026-87818: GitPython 3.1.59 blocks a previously available local-file read path through unsafe git diff options such as -O/--orderfile. Affects gitpython versions >= 3.1.59, < 3.1.60. Fixed in 3.1.60. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitPython is a Python library used for interacting with Git repositories. It provides a high-level interface for Git operations, allowing developers to automate tasks and manipulate Git repositories programmatically. The library is widely used in various applications that require version control functionalities. However, a vulnerability has been identified in version 3.1.59, which allows for potential local file disclosure through unsafe diff options.
Vulnerability Detail
The vulnerability arises from the use of the --no-index option in GitPython's diff API, which allows arbitrary filesystem paths instead of repository-relative pathspecs. When combined with the -I/--ignore-matching-lines option, it creates a content-dependent Boolean oracle that can be exploited to read local file contents. This issue was confirmed in GitPython version 3.1.59, where the original unsafe option path was blocked, but the alternate path remains accessible without enabling unsafe options. Attackers can exploit this vulnerability by influencing diff options and paths, leading to the potential disclosure of sensitive local files.
How To Fix
Latest published version: 3.2.1 as of 23 Oct 2026
pip install --upgrade "gitpython==3.2.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.60
This is the first release that contains the fix.
pip install --upgrade "gitpython==3.1.60"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the --no-index option in the diff API unless absolutely necessary. Additionally, ensure that the allow_unsafe_options parameter is set to False to prevent the use of unsafe options.
Conclusion
The vulnerability CVE-2026-87818 in GitPython poses a significant risk of local file disclosure through the misuse of the --no-index option in the diff API. It is crucial for users to update to the patched version 3.1.60 or later to safeguard against potential exploitation. Additionally, employing workarounds can help mitigate risks until an upgrade is feasible.
See every vulnerability recorded for gitpython →
FAQ
CVE-2026-87818 is a vulnerability in GitPython that allows local file disclosure through the use of the --no-index option in the diff API.
GitPython version 3.1.59 is affected by this vulnerability. Version 3.1.60 and later contain the necessary fixes.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The potential impact includes unauthorized disclosure of local files that are readable by the process running GitPython, which could lead to exposure of sensitive information.
If immediate upgrade is not possible, avoid using the --no-index option and ensure that the allow_unsafe_options parameter is set to False to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for gitpython.
