CVE-2026-78676

COMPONENT VERSION RANGE

NewScan fingerprints GitPython from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-25. GitPython's third 2026 batch, three ids sharing fix 3.1.59, reached by the same route as the row above (a pin in an anonymously served requirements.txt/Pipfile.lock; version-match only, nothing is exploited). CVE-2026-78676 (9.3) is recorded `critical` under docs/severity-standard.md and not `high` like its 8.1 sibling because it ends in EXECUTION rather than file read: re-serializing a multi-line git-config value corrupts dormant quoted text into a live directive, and `core.hooksPath` is one of the directives that lands, so the next git invocation runs attacker-chosen code. CVE-2026-78677 (8.7) omits --separate-git-dir from unsafe_git_clone_options, creating git directories outside the clone destination; CVE-2026-78678 (7.1) omits --contents and -S from unsafe_git_revision_options, giving arbitrary file read through Repo.blame. THIS BAND DELIBERATELY OVERLAPS the lt 3.1.57 row and is not merged with it, which is the whole design decision here. Merging into one lt 3.1.59 row carrying all five ids would tell a 3.1.57 or 3.1.58 install it still has CVE-2026-73620/73619, which 3.1.57 fixed - flagging a patched build, the exact failure the Jenkins row above splits per line to avoid. Keeping them separate costs a very old install two findings whose remediation is the same single upgrade; every claim in each row stays true for every version that row matches, and noise is the safe direction to err in while a false positive is not. CVE-2026-76217 (fix 3.1.58) is still unclaimed for the same bound reason as before - it would over-claim on exactly 3.1.58.