CVE-2026-73619 in GitPython

Riassunto

di MITRE • 13/08/2026

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

• Responsabile: VulnCheck
• Prenotare: 13/08/2026
• Divulgazione: 13/08/2026
• Moderazione: accettato
• Voce: VDB-389396
• CPE: pronto
• CWE: CWE-200 (confermato)
• CVSS: 4.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Attività: molto basso
• Settore: Telecommunication, Chemical, ...

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-73619
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73619
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-73619/