CVE-2026-73619 gitpython-developers CVE debrief

Who should care

Users of GitPython, especially those who use Repo.archive() functionality, should be aware of this vulnerability and take steps to mitigate it. This includes updating GitPython to version 3.1.57 or later, restricting access to Repo.archive() functionality, and monitoring for suspicious activity related to GitPython archives. Security teams and vulnerability management teams should also be aware of this vulnerability and take steps to mitigate it in their environments. Additionally, operators and administrators of affected systems should be aware of this vulnerability and take steps to protect their systems. This vulnerability can have a significant impact on the security of affected systems, and it is essential to take steps to mitigate it promptly. The vulnerability can be exploited by attackers to read sensitive files from the filesystem, which can lead to further exploitation and compromise of affected systems. Therefore, it is crucial to prioritize patching and mitigation efforts to prevent potential arbitrary file reads and other security risks associated with this vulnerability. The vulnerability is particularly concerning for users who rely on Repo.archive() functionality, as it can be exploited to read arbitrary files from the filesystem and include them in the generated archive. As such, users should take immediate action to mitigate this vulnerability and prevent potential security breaches. The incomplete denylist in the unsafe_git_archive_options guard is a critical issue that needs to be addressed promptly to prevent exploitation. By prioritizing patching and mitigation efforts, users can prevent potential security breaches and protect their systems from exploitation. The vulnerability highlights the importance of maintaining up-to-date software and ensuring that security patches are applied promptly to prevent exploitation. Users should also review their current security controls and ensure that they are adequate to prevent exploitation of this vulnerability. Furthermore, users should monitor their systems for suspicious activity related to GitPython archives and take steps to detect and respond to potential security incidents. By taking these step

Technical summary

The GitPython library before version 3.1.57 has an incomplete denylist in the unsafe_git_archive_options guard. This allows attackers to use --add-file and --add-virtual-file options with Repo.archive() to read arbitrary files from the filesystem and include them in the generated archive. The vulnerability is due to the incomplete denylist, which fails to block these options. Attackers can exploit this vulnerability to read sensitive files from the filesystem.

Defensive priority

GitPython users should prioritize patching to prevent potential arbitrary file reads.

Recommended defensive actions

• Update GitPython to version 3.1.57 or later
• Restrict access to Repo.archive() functionality
• Monitor for suspicious activity related to GitPython archives
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description indicates that GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard. This allows attackers to supply --add-file and --add-virtual-file options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.

Official resources