CVE-2026-73619 — GitPython before 3.1.57 Arbitrary File Read via Repo.archive()
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these …
Published: 2026-08-13 · CVSS: 7.1 · CVSS 4.0
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7