Executive brief
GitPython's Repo.blame() function is used by applications to query source code authorship and commit history. The function has an input validation check intended to block dangerous Git command-line options, but the allowlist is incomplete—it blocks write operations (--output) but not read operations (--contents, -S). An attacker controlling the revision parameter can inject these options to read arbitrary files on the system as the process owner, with results leaked back to the caller.
Technical details
The vulnerability is an incomplete option denylist in the unsafe_git_revision_options guard used by Repo.blame() and Repo.blame_incremental(). The denylist contains only ["--output", "-o"], which block file writes. However, the `git blame` command also honors --contents <file> and -S <file> options that cause the specified file's lines to be echoed into the blame output—enabling arbitrary file READ. Neither option appears in the denylist. When an attacker-controlled revision string containing --contents=/etc/passwd is passed to blame(), the check_unsafe_options() guard fails to block it (the canonical name "contents" is not in the denylist), and the option is passed unsanitized to the git command, placing it before the -- separator. The file's line contents appear in the returned blame result. The attack requires the caller to forward user-influenced revision values to blame(); no authentication or user interaction is needed. Patched in version 3.1.59.
Affected products
- GitPython GitPython <= 3.1.58
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Fixed in version 3.1.59