CVE-2026-73619
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.
Risk Assessment
An attacker can read sensitive files from the server, potentially leading to disclosure of confidential data such as configurations, keys, or user data.
Recommendation
It is recommended to upgrade GitPython to version 3.1.57 or later, which includes the fix for the incomplete denylist.
Original NVD description (English source)
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.