| Package | Affected versions | Patched versions |
|---|---|---|
| gitpython | ≥ 3.1.59, < 3.1.60≥ 3.1.59 | 3.1.60 |
| gitpython | < 3.1.60 | 3.1.60 |
This advisory has been withdrawn because it is a duplicate of GHSA-whh4-5q6c-9v3x. This link is maintained to preserve external references.
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free