GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)
High severity
GitHub Reviewed
Published
Aug 10, 2026
in
gitpython-developers/GitPython
•
Updated Sep 8, 2026
Give feedback on Dependabot alerts