What is GHSA-rw58-wc66-99g4?

GHSA-rw58-wc66-99g4 is a security advisory published by GitHub Security Advisories with High severity. Duplicate Advisory: GitPython 3.1.59: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

Which CVE IDs does GHSA-rw58-wc66-99g4 cover?

GHSA-rw58-wc66-99g4 covers the following CVE IDs: CVE-2026-87818. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rw58-wc66-99g4?

GHSA-rw58-wc66-99g4 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-rw58-wc66-99g4?

GHSA-rw58-wc66-99g4 affects 1 product, including: pip/gitpython:\u003e= 3.1.59, \u003c 3.1.60.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 30, 2026

GHSA-rw58-wc66-99g4HighCVSS 6.5

Duplicate Advisory: GitPython 3.1.59: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

Vendor

GitHub Security Advisories

Published

September 9, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-87818 →

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-whh4-5q6c-9v3x. This link is maintained to preserve external references.

Original Description

GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.

🎯 Affected products1

pip/gitpython:>= 3.1.59, < 3.1.60

🔗 CVE IDs covered (1)

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products1

🔗 References (4)