{"id":"ghsa-ghsa-23mf-xhv8-69c2","seq":1708805,"kind":"advisory","title":"GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)","url":"https://github.com/advisories/GHSA-23mf-xhv8-69c2","permalink":"https://vulnpulse.app/items/ghsa-ghsa-23mf-xhv8-69c2","summary":"影響: pip:GitPython <= 3.1.62 → 3.2.0\n> A note on the referenced files. This report was submitted through GitHub's private > vulnerability reporting API, which carries no attachments. Every transcript this report leans > on is reproduced inline above, verbatim. The file names it mentions (poc.sh, poc.log, > per-case transcripts, evidence.md, negative-controls.md, blob-sweep tables) are the local > evidence bundle those inline excerpts were extracted from, with a checksum manifest. I am happy > to send the bundle by any channel you…","severity":"high","techs":["python"],"cves":[],"tags":["GHSA-23mf-xhv8-69c2","GitPython"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T15:28:03.000Z","fetched_at":"2026-10-27T21:03:52.214Z"}