GHSA-whh4-5q6c-9v3x: GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
GitPython 3.1.59 blocks a previously available local-file read path through unsafe git diff options such as -O/–orderfile.
However, the high-level diff API still permits –no-index with the default allow_unsafe_options=False.
–no-index changes the semantics of the paths arguments: instead of repository-relative pathspecs, Git interprets them as arbitrary filesystem paths.
When combined with the still-allowed -I/–ignore-matching-lines option, this creates a content-dependent Boolean oracle over a caller-selected local file.
This was reproduced against the published GitPython 3.1.59 wheel.
The original unsafe-option path is blocked in 3.1.59, while this alternate path remains reachable without setting allow_unsafe_options=True.
References
- github.com/advisories/GHSA-whh4-5q6c-9v3x
- github.com/gitpython-developers/GitPython/commit/09f2cf383a992d1af697364569e9f384748c1bd8
- github.com/gitpython-developers/GitPython/pull/2217
- github.com/gitpython-developers/GitPython/releases/tag/3.1.60
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-whh4-5q6c-9v3x
- github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3983.yaml
- www.vulncheck.com/advisories/gitpython-3.1.59-local-file-content-oracle-via-no-index
Code Behaviors & Features
Detect and mitigate GHSA-whh4-5q6c-9v3x with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →