GHSA-whh4-5q6c-9v3x (CVE-2026-87818) lists GitPython 3.1.59 as the only affected release, but the same --no-index/-I oracle also works on older releases. We tested 3.1.30, 3.1.40, 3.1.53, 3.1.58 and 3.1.59, and 3.1.60 (#2217) is the first release that blocks it.

On each of those releases, with the default allow_unsafe_options=False and both paths outside the repository, repo.index.diff(None, no_index=True, I=pattern, paths=[empty_file, secret_file], create_patch=True) returns an empty DiffIndex when the pattern matches and raises GitCommandError with status 1 when it doesn't. Repeating the call recovered a random 6-character token one character at a time. 3.1.60 raises UnsafeOptionError. Tested with git 2.56.0 and Python 3.15.2.

This matches the code: before 3.1.59, diff() either ran no unsafe-option check (3.1.53 and earlier) or blocked only --output and -o (3.1.54 to 3.1.58), so nothing stopped --no-index. Those releases also accept -O/--orderfile, which #2208 closed in 3.1.59 without an advisory of its own. As far as we can find, no published advisory covers reading local files through diff() before 3.1.59.

Was the advisory scoped to the 3.1.59 bypass on purpose? If not, would you widen it to < 3.1.60, or would you rather cover the older read path in a separate advisory?

We found this while reviewing Homebrew's advisory data.