Argument Injection Vulnerability in GitPython by GitPython Developers

CVE-2026-73621

What is CVE-2026-73621?

GitPython versions prior to 3.1.56 contain an argument injection vulnerability in the Commit.count() method. This vulnerability allows an attacker to manipulate the options passed to Commit.count, which are directly forwarded to the git rev-list command without adequate safety checks. By supplying a malicious path through the output parameter, an attacker can cause git rev-list to open and truncate the specified file to zero bytes. This unauthorized action can lead to file destruction at the privilege level of the process executing the command, resulting in potential data loss without any control over the file's content.

References