PyPI/gitpython CVE-2026-73621: medium 5.4, EPSS 0.36%

GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count

Action: Upgrade gitpython to 3.1.56 or later.

pip install gitpython==3.1.56

Affected

Fixed versions

Sources

• osv: GHSA-p538-c434-8v24
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-p538-c434-8v24
• https://github.com/gitpython-developers/GitPython/pull/2184
• https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2
• https://github.com/gitpython-developers/GitPython
• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.56

CVE-2026-73621 · published 2026-08-03T20:23:17Z · modified 2026-09-10T13:10:55.177009469Z · JSON