GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
影響: pip:GitPython <= 3.1.62 → 3.2.0
> A note on the referenced files. This report was submitted through GitHub's private > vulnerability reporting API, which carries no attachments. Every transcript this report leans > on is reproduced inline above, verbatim. The file names it mentions (poc.sh, poc.log, > per-case transcripts, evidence.md, negative-controls.md, blob-sweep tables) are the local > evidence bundle those inline excerpts were extracted from, with a checksum manifest. I am happy > to send the bundle by any channel you…
| 정보원 | GitHub Advisory Database |
|---|---|
| 수집 시각 | 2026. 10. 28. 오전 06:03 |
| 데이터 | Markdown JSON |
2026. 10. 28. 오전 12:28, GitHub Advisory Database에서 "GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Python.