CVE-2026-73619

EUVD-2026-57823
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 32.88%
Affected Products (NVD)
VendorProductVersion
gitpython_projectgitpython
𝑥
< 3.1.57
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
python-git
bookworm
vulnerable
forky
3.1.61-1
fixed
sid
3.1.62-1
fixed
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
python-git
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
Common Weakness Enumeration
References
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr
https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-archive
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr