Hi,

The following vulnerabilities were published for python-git.

CVE-2026-78675[0]:
| GitPython before 3.1.59 fails to disable merge_includes when parsing
| .gitmodules, allowing attackers to disclose local file content by
| including arbitrary file paths via [include] directives. Attackers
| can craft a malicious .gitmodules file with include directives
| pointing to sensitive files; when repo.submodules is accessed,
| GitConfigParser raises MissingSectionHeaderError embedding the
| target file's first line verbatim in the exception message.


CVE-2026-78676[1]:
| GitPython before 3.1.59 fails to safely re-serialize multi-line git-
| config values during write operations, corrupting dormant quoted
| values into injected directives like core.hooksPath. Attackers can
| craft config files with embedded newlines that become live git
| directives after any unrelated GitPython config write, enabling
| arbitrary code execution via hook invocation.


CVE-2026-78677[2]:
| GitPython before 3.1.59 omits --separate-git-dir from
| unsafe_git_clone_options, allowing attackers to create arbitrary git
| directories outside the intended clone destination. Attackers can
| pass a separate_git_dir parameter to Repo.clone_from() or
| Repo.clone() to redirect repository metadata to an attacker-
| controlled filesystem path, enabling arbitrary directory creation
| and potential hook execution.


CVE-2026-78678[3]:
| GitPython versions before 3.1.59 contain an incomplete denylist in
| the unsafe_git_revision_options guard that omits --contents and -S
| options, allowing attackers to read arbitrary files by passing these
| options to Repo.blame(). Attackers can supply revision values like
| --contents=/etc/passwd to leak file contents through the blame
| result returned to the caller.


CVE-2026-78679[4]:
| GitPython before 3.1.59 contains an arbitrary file read
| vulnerability in TagReference.create() where a positional reference
| parameter bypasses the unsafe option guard. Attackers can supply a
| reference value like --file=<path> to read arbitrary files, with
| contents returned in the annotated tag message.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-78675
https://www.cve.org/CVERecord?id=CVE-2026-78675
[1] https://security-tracker.debian.org/tracker/CVE-2026-78676
https://www.cve.org/CVERecord?id=CVE-2026-78676
[2] https://security-tracker.debian.org/tracker/CVE-2026-78677
https://www.cve.org/CVERecord?id=CVE-2026-78677
[3] https://security-tracker.debian.org/tracker/CVE-2026-78678
https://www.cve.org/CVERecord?id=CVE-2026-78678
[4] https://security-tracker.debian.org/tracker/CVE-2026-78679
https://www.cve.org/CVERecord?id=CVE-2026-78679

Regards,
Salvatore