# GitPython TagReference.create arbitrary file read via positional argument injection

Source: https://junglewise.ai/threats/gitpython-tagreference-create-arbitrary-file-read-via-positional-4b3f134a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2026-08-25

GitPython is a Python library used to interact with Git repositories programmatically. A vulnerability in the TagReference.create() method allows attackers to read arbitrary files from the server by supplying a specially crafted reference parameter. An application using GitPython that forwards untrusted input to this method could expose sensitive files like SSH keys or configuration credentials.

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 25 August 2026.

**Which products and versions are affected?** GitPython developers GitPython < 3.1.59.

**Is there a fix for This vulnerability?** A patch was published on 2026-08-25: Fix released in version 3.1.59 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an argument injection flaw (CWE-88, CWE-73) in GitPython's TagReference.create() method. A previous fix (commit 3af0c251) attempted to block unsafe git options like --file by inspecting only keyword arguments, but the method forwards caller-supplied positional arguments (path and reference) directly to the underlying git command without validation. An attacker can pass reference="--file=/path/to/file" which bypasses the guard and reaches git tag as a legitimate option, causing git to read the file and embed its contents in the annotated tag message. The vulnerability requires an embedding application to forward untrusted input into the reference parameter with allow_unsafe_options=False (the default). The fix in 3.1.59 includes positional arguments in the unsafe-options check or places a -- separator before positional arguments.

## Affected products

- GitPython developers GitPython < 3.1.59

## Timeline

- 2026-08-10: disclosed
- 2026-08-25: advisory
- 2026-08-25: patched: Fix released in version 3.1.59
- 2026-09-08: other: Duplicate advisory (GHSA-6rj2-96f5-chj9) withdrawn, canonical advisory is GHSA-3wxw-xv34-2frg

## References

- [https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg)
- [https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create](https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create)