CVE-2026-73621 in GitPython
Summary
by MITRE • 08/13/2026
GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_unsafe_options guard present in the sibling iter_items method. An attacker who can control options passed to Commit.count (e.g., via an application that forwards a user-supplied options dict) can supply output=<path>, causing 'git rev-list --output=<path>' to open and truncate the target file to zero bytes before revision parsing. This allows destruction/blanking of an arbitrary file at the process's privilege level (no content control, 0-byte truncation).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in GitPython versions prior to 3.1.56 represents a critical argument injection flaw within the Commit.count() method that stems from insufficient input validation and sanitization practices. This weakness allows attackers to manipulate the underlying git command execution by injecting malicious arguments directly into the git rev-list command. The issue manifests when user-supplied options are forwarded to the commit counting functionality without proper safety checks, creating a pathway for arbitrary file manipulation at the privilege level of the executing process. The vulnerability specifically affects the Commit.count() method which lacks the check_unsafe_options guard that is present in the sibling iter_items method, establishing a dangerous inconsistency in security controls within the same codebase.
The technical exploitation of this vulnerability occurs through the strategic injection of the output=<path> parameter into the git rev-list command execution. When an attacker crafts a malicious options dictionary containing this parameter and passes it to Commit.count(), the underlying git command executes as 'git rev-list --output=<path>' which opens and truncates the specified file to zero bytes. This behavior represents a form of destructive file manipulation that operates at the privilege level of the process executing the GitPython library, eliminating any content control mechanisms while providing precise file truncation capabilities. The vulnerability's impact extends beyond simple data destruction as it can be leveraged for more sophisticated attacks including denial of service through critical file truncation or potential privilege escalation scenarios where sensitive system files are targeted.
The operational implications of this vulnerability are significant across various deployment scenarios where GitPython is utilized in applications handling user input or external data sources. Applications that forward user-supplied options to GitPython commit counting functions become immediately vulnerable to exploitation, creating attack vectors in web applications, CI/CD pipelines, and automated systems that process untrusted git metadata. The lack of content control in the truncation mechanism means attackers can target any file accessible to the process running GitPython, potentially compromising system integrity through targeted file destruction or disruption of critical infrastructure components. This vulnerability particularly affects systems where GitPython is used for repository analysis, commit history processing, or automated git operations that accept external configuration parameters.
Mitigation strategies for this vulnerability require immediate attention through version upgrading to GitPython 3.1.56 or later, which implements proper input validation and the missing check_unsafe_options guard in the Commit.count() method. Organizations should conduct comprehensive code reviews to identify all instances where user-supplied options are forwarded to GitPython commit-related methods, implementing strict input sanitization and parameter validation before any external data reaches the vulnerable functions. Additional protective measures include restricting file system permissions for processes executing GitPython operations, implementing proper access controls on target files, and establishing monitoring systems to detect unauthorized file truncation events. Security practitioners should also consider implementing runtime protections such as process isolation, privilege reduction techniques, and network segmentation to limit the potential impact of successful exploitation attempts. The vulnerability aligns with CWE-77 and ATT&CK technique T1485 which addresses data destruction and file permissions manipulation, emphasizing the critical nature of proper input validation in command execution contexts.