Insecure DLL loading in GitPython - #VU145797
Published: August 26, 2026
Vulnerability identifier: #VU145797
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-427
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper access control in Repo._config_reader and git directory resolution when opening a crafted repository and reading repository configuration. A remote attacker can provide a crafted config with include directives to disclose sensitive information.
User interaction is required to open or clone the crafted repository.
Affected software
GitPython
Remediation
Install security update from vendor's website.
GitPython - update to 3.1.60