CVE-2026-73621
GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_unsafe_options guard present in the sibling iter_items method. An attacker who can control options passed to Commit.count (e.g., via an application that forwards a user-supplied options dict) can supply output=<path>, causing 'git rev-list --output=<path>' to open and truncate the target file to zero bytes before revision parsing. This allows destruction/blanking of an arbitrary file at the process's privilege level (no content control, 0-byte truncation).
- Affected products
- Gitpython
- CVSS 3.1
- 5.4 MEDIUM
- EPSS
- 0.2% (10th percentile)
- Weakness
- CWE-88
- NVD status
- Received
- Published
- 2026-08-13
No indexed exploits for CVE-2026-73621 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-73621 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.