CVE-2026-87818
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 09, 2026
Vendor
unknown
Description
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.