{"vulnerability": "CVE-2026-7867", "sightings": [{"uuid": "697c18e1-46ab-4395-ac84-4eb6c103d58f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78679", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/iblly34rmrd7h", "content": "CVE-2026-78679 - GitPython before 3.1.59 Arbitrary File Read via TagReference.create\nCVE ID : CVE-2026-78679\n \n Published : Aug. 25, 2026, 1:30 a.m. | 34\u00a0minutes ago\n \n Description : GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create()...", "creation_timestamp": "2026-08-25T02:14:29.643935Z"}, {"uuid": "4efaaf49-dbb1-4ebb-ac39-00149a4803d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtuqyskh5o2y", "content": "CVE-2026-78676 - gitpython\nIf you use GitPython version 3.1.58 or older, specially crafted configuration files can be changed when the software writes its settings, turning harmless text into\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitpython #gitpythondevelopers #CVE #infosec", "creation_timestamp": "2026-08-25T02:20:04.191740Z"}, {"uuid": "b4844971-3bc2-4f37-b82e-b64efc1c5b35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78676", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117153911650352822", "content": "CVE-2026-78676 | GitPython <3.1.59 has a CRITICAL argument injection flaw: multi-line git-config values can become active directives, enabling arbitrary code execution via git hooks. Patch status unknown \u2014 avoid untrusted configs. https://radar.offseq.com/threat/cve-2026-78676-improper-neutralization-of-argument-delimiters-in-a-command-argument-injection-in-98aef85f24190fbe #OffSeq #CVE202678676 #git #infosec", "creation_timestamp": "2026-08-25T03:00:26.436451Z"}, {"uuid": "4a384346-60da-419d-b321-93ad9c6ddd5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-78676", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtutb2i47z2w", "content": "GitPython <3.1.59 faces CRITICAL argument injection (CVE-2026-78676): attackers can execute arbitrary code via crafted git config files. Avoid untrusted configs until a patch is confirmed. https://radar.offseq.com/threat/cve-2026-78676-improper-neutralization-of-argument-delimiters-in-a-command-a...", "creation_timestamp": "2026-08-25T03:00:28.619399Z"}, {"uuid": "68f4faf4-78e9-47ce-910b-d159f27f5276", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtux2buv5a2y", "content": "\ud83d\udea8 CVE-2026-78676 \u2014 CVSS 9.3 CRITICAL\n\nGitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-78676\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-25T04:08:15.970841Z"}, {"uuid": "851d8c01-2bda-46b7-a98c-f01e2b39e6e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtv23rwqqz2b", "content": "Daily IT Security Digest \u2014 2026-08-25\n# Daily IT Security Digest \u2014 2026-08-25\n\n## 1. Critically Vulnerable GitPython (CVE-2026-78676) \u2014 Arbitrary Code Execution via Malicious .gitconfig\n\nA critical argument injection flaw (CVSS 9.3) exists in GitPython versions below 3.1.59. Multi-line git-config", "creation_timestamp": "2026-08-25T05:02:47.703673Z"}, {"uuid": "7adc0894-41b5-4f43-b8de-c26ea2dc273c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mtv23srsqy2n", "content": "Daily IT Security Digest \u2014 2026-08-25\n[@stemshop.bsky.social](https://stemshop.top/cve/CVE-2026-78676)]\n\n## 2. Critical Sandbox Escape in `isolated-vm` Library \u2014 Remote Code Execution via Type Confusion\n\nA critical type confusion vulnerability in the `isolated-vm` JavaScript sandbox library allows", "creation_timestamp": "2026-08-25T05:02:48.254951Z"}, {"uuid": "7d6b2062-c87b-4965-951f-7fd7af79645d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-78676", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtvfofvooj23", "content": "CVE-2026-78676\nIf your applications use the GitPython library version older than 3.1.59, a specially crafted Git configuration file can cause the library to insert harmful commands when it saves settings. This can lead to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-25T08:30:04.366898Z"}]}