CVE-2026-73621
Received Received - Intake

Argument Injection in GitPython via Commit.count()

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_unsafe_options guard present in the sibling iter_items method. An attacker who can control options passed to Commit.count (e.g., via an application that forwards a user-supplied options dict) can supply output=<path>, causing 'git rev-list --output=<path>' to open and truncate the target file to zero bytes before revision parsing. This allows destruction/blanking of an arbitrary file at the process's privilege level (no content control, 0-byte truncation).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73621
EUVD
EUVD-2026-57825

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gitpython gitpython to 3.1.56 (exc)
gitpython_developers gitpython to 3.1.56 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitPython before 3.1.56 has an argument injection flaw in the Commit.count() method. User-supplied arguments are forwarded to the 'git rev-list' command without validation. An attacker can pass a malicious output parameter (e.g., output=<path>) to truncate an arbitrary file to zero bytes before processing revisions. This results in file destruction at the process's privilege level.

Detection Guidance

Check GitPython version with pip show GitPython. If version is below 3.1.56, the system is vulnerable. Review applications using Commit.count() for user-supplied options that could pass malicious arguments.

Impact Analysis

An attacker with low privileges can exploit this to destroy or blank critical files on your system, such as configuration files, logs, or databases. The attack requires no user interaction and can be executed remotely if the application accepts user-supplied options. Files are truncated to zero bytes, causing data loss and potential system disruption.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data integrity and availability) and HIPAA (integrity and availability of protected health information) by enabling unauthorized file destruction. Loss of critical data may result in violations of regulatory requirements for data protection and integrity.

Mitigation Strategies

Upgrade GitPython to version 3.1.56 or later. Audit code for Commit.count() usage and ensure no user input is directly passed to it. Replace Commit.count() with safer alternatives like iter_items where possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73621. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart