new file mode 100644
@@ -0,0 +1,181 @@
+From 51216053bd6885b546be8e9ed2e8e1000e7ee5a3 Mon Sep 17 00:00:00 2001
+From: Byron <sebastian.thiel@icloud.com>
+Date: Wed, 5 Aug 2026 04:48:36 +0200
+Subject: [PATCH] Block file-reading Git options
+
+<!-- agent -->
+Reject file-reading options passed to blame, diff, and tag APIs. Inspect
+positional values after resolving aliases, recognize unsafe options
+behind command-specific short-flag clusters, and retain the explicit
+allow_unsafe_options escape hatch. This closes GHSA-5xxx-qhh7-9287 and
+GHSA-3wxw-xv34-2frg and covers the adjacent diff order-file sink.
+
+Regression tests cover long, short, and clustered options, incremental blame,
+tag path/reference positionals, the ref keyword alias, both diff entry points,
+and preservation of diff pickaxe behavior.
+
+Git baseline: cf5497b14c; git-blame, git-diff, and git-tag document the relevant file-input options.
+
+CVE: CVE-2026-78678 CVE-2026-78679
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6]
+
+Backport Changes:
+- Omitted test/test_diff.py, test/test_refs.py, test/test_remote.py,
+ test/test_repo.py because the Wrynose PyPI source archive does not include
+ the test suite and the python3-git recipe does not run it.
+
+Assisted-by: GPT 5.6
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/cmd.py | 4 +++-
+ git/diff.py | 7 ++++---
+ git/index/base.py | 3 ++-
+ git/refs/tag.py | 10 ++++++----
+ git/repo/base.py | 24 ++++++++++++++++++++----
+ 5 files changed, 35 insertions(+), 13 deletions(-)
+
+diff --git a/git/cmd.py b/git/cmd.py
+index c509ff1a..ddab399e 100644
+--- a/git/cmd.py
++++ b/git/cmd.py
+@@ -743,7 +743,9 @@ class Git(metaclass=_GitMeta):
+ return dashify(option_tokens[0])
+
+ @classmethod
+- def check_unsafe_options(cls, options: List[str], unsafe_options: List[str]) -> None:
++ def check_unsafe_options(
++ cls, options: List[str], unsafe_options: List[str], clusterable_short_options: str = "46flnqsv"
++ ) -> None:
+ """Raise :class:`~git.exc.UnsafeOptionError` for blocked option spellings.
+
+ In addition to exact matches, this rejects abbreviated long options accepted
+diff --git a/git/diff.py b/git/diff.py
+index 9a1f107b..032dfb25 100644
+--- a/git/diff.py
++++ b/git/diff.py
+@@ -216,8 +216,8 @@ class Diffable:
+ to be read and diffed.
+
+ :param allow_unsafe_options:
+- If ``True``, allow options such as ``--output`` that can write to arbitrary
+- filesystem paths.
++ If ``True``, allow options such as ``--output`` and ``-O`` that can write to
++ or read from arbitrary filesystem paths.
+
+ :param kwargs:
+ Additional arguments passed to :manpage:`git-diff(1)`, such as ``R=True`` to
+@@ -234,7 +234,8 @@ class Diffable:
+ if not allow_unsafe_options:
+ Git.check_unsafe_options(
+ options=Git._option_candidates([other], kwargs),
+- unsafe_options=self.repo.unsafe_git_revision_options,
++ unsafe_options=self.repo.unsafe_git_diff_options,
++ clusterable_short_options="46abceflmnpqrstuvwzBCDMNRW",
+ )
+
+ args: List[Union[PathLike, Diffable]] = []
+diff --git a/git/index/base.py b/git/index/base.py
+index c608f2d5..cefd6291 100644
+--- a/git/index/base.py
++++ b/git/index/base.py
+@@ -1550,7 +1550,8 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
+ if not allow_unsafe_options:
+ Git.check_unsafe_options(
+ options=Git._option_candidates([other], kwargs),
+- unsafe_options=self.repo.unsafe_git_revision_options,
++ unsafe_options=self.repo.unsafe_git_diff_options,
++ clusterable_short_options="46abceflmnpqrstuvwzBCDMNRW",
+ )
+
+ # Only run if we are the default repository index.
+diff --git a/git/repo/base.py b/git/repo/base.py
+index 56a19dc5..d8cc5306 100644
+--- a/git/repo/base.py
++++ b/git/repo/base.py
+@@ -196,6 +196,19 @@ class Repo:
+ "-o",
+ ]
+
++ unsafe_git_blame_options = unsafe_git_revision_options + [
++ # These options read from arbitrary files and expose their contents through blame output.
++ "--contents",
++ "-S",
++ "--ignore-revs-file",
++ ]
++
++ unsafe_git_diff_options = unsafe_git_revision_options + [
++ # Reads caller-controlled order patterns from an arbitrary file.
++ "-O",
++ "--orderfile",
++ ]
++
+ # Invariants
+ config_level: ConfigLevels_Tup = ("system", "user", "global", "repository")
+ """Represents the configuration level of a configuration file."""
+@@ -1100,7 +1113,7 @@ class Repo:
+ :manpage:`git-rev-parse(1)` is a valid option.
+
+ :param allow_unsafe_options:
+- Allow unsafe options in revision argument, like ``--output``.
++ Allow unsafe options in revision argument, like ``--output`` or ``--contents``.
+
+ :return:
+ Lazy iterator of :class:`BlameEntry` tuples, where the commit indicates the
+@@ -1112,7 +1125,9 @@ class Repo:
+ """
+ if not allow_unsafe_options:
+ Git.check_unsafe_options(
+- options=Git._option_candidates([rev], kwargs), unsafe_options=self.unsafe_git_revision_options
++ options=Git._option_candidates([rev], kwargs),
++ unsafe_options=self.unsafe_git_blame_options,
++ clusterable_short_options="46bceflnpqstvw",
+ )
+
+ data: bytes = self.git.blame(rev, "--", file, p=True, incremental=True, stdout_as_string=False, **kwargs)
+@@ -1204,7 +1219,7 @@ class Repo:
+ :manpage:`git-rev-parse(1)` is a valid option.
+
+ :param allow_unsafe_options:
+- Allow unsafe options in revision argument, like ``--output``.
++ Allow unsafe options in revision argument, like ``--output`` or ``--contents``.
+
+ :return:
+ list: [git.Commit, list: [<line>]]
+@@ -1220,7 +1235,8 @@ class Repo:
+ if not allow_unsafe_options:
+ Git.check_unsafe_options(
+ options=Git._option_candidates([rev, rev_opts_list], kwargs),
+- unsafe_options=self.unsafe_git_revision_options,
++ unsafe_options=self.unsafe_git_blame_options,
++ clusterable_short_options="46bceflnpqstvw",
+ )
+ data: bytes = self.git.blame(rev, *rev_opts_list, "--", file, p=True, stdout_as_string=False, **kwargs)
+ commits: Dict[str, Commit] = {}
+diff --git a/git/refs/tag.py b/git/refs/tag.py
+index 487eaa14..7b002f2f 100644
+--- a/git/refs/tag.py
++++ b/git/refs/tag.py
+@@ -134,15 +134,17 @@ class TagReference(Reference):
+ :return:
+ A new :class:`TagReference`.
+ """
++ legacy_ref = kwargs.pop("ref", None)
++ if legacy_ref:
++ reference = legacy_ref
++
+ if not allow_unsafe_options:
+ Git.check_unsafe_options(
+- options=Git._option_candidates([], kwargs),
++ options=Git._option_candidates([path, reference], kwargs),
+ unsafe_options=cls.unsafe_git_tag_options,
++ clusterable_short_options="46adefilnqsv",
+ )
+
+- if "ref" in kwargs and kwargs["ref"]:
+- reference = kwargs["ref"]
+-
+ if "message" in kwargs and kwargs["message"]:
+ kwargs["m"] = kwargs["message"]
+ del kwargs["message"]
@@ -43,6 +43,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
file://CVE-2026-76222_p1.patch \
file://CVE-2026-76222-regression.patch \
file://CVE-2026-76222_p2.patch \
+ file://CVE-2026-78678_CVE-2026-78679.patch \
"
SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
This patch applies the upstream fix as referenced in [2] and [3], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-78678 [3] https://nvd.nist.gov/vuln/detail/cve-2026-78679 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../CVE-2026-78678_CVE-2026-78679.patch | 181 ++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 182 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-78678_CVE-2026-78679.patch