GitPython .gitmodules Local File Disclosure via MissingSectionHeaderError

Executive Summary

CVE-2026-78675 is a high-severity vulnerability in GitPython versions 3.1.58 and earlier. It allows attackers to disclose local file content by crafting a malicious .gitmodules file with [include] directives pointing to sensitive files. When repo.submodules is accessed, the parser follows the directive and reads the file. If the file lacks valid git-config syntax, an error message exposes the first line of the file, revealing secrets like API keys or credentials.

Useful 0 Not Useful 0

Detection Guidance

Check for GitPython versions 3.1.58 or earlier using pip show GitPython or pip list. Inspect .gitmodules files in repositories for suspicious [include] directives pointing to sensitive files like /etc/passwd or .env. Monitor error logs for MissingSectionHeaderError exceptions containing file content.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can expose sensitive information such as API keys, database credentials, or other secrets stored in local files. Attackers can craft malicious .gitmodules files to trigger error messages that leak the first line of targeted files. This may occur during routine operations like listing submodules in an untrusted repository.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive data such as API keys or database credentials through error messages. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Disclosure of such data via error logs or trackers violates these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GitPython to version 3.1.59 or later immediately. Avoid cloning or interacting with untrusted repositories. If using GitPython programmatically, ensure SubmoduleConfigParser is initialized with merge_includes=False.

Useful 0 Not Useful 0