{"action":"Upgrade gitpython to 3.1.56 or later.","affected":[{"fixed":"3.1.56","introduced":"0"}],"component":"gitpython","cve_ids":["CVE-2026-73621"],"ecosystem":"PyPI","epss":0.0036,"exploited":false,"fixed_versions":["3.1.56"],"ghsa_id":"GHSA-p538-c434-8v24","id":"tcs_01M5KH8W8DSCMXANNGT03Q7DC2","modified_at":"2026-09-10T13:00:04.116168992Z","published_at":"2026-08-13T12:17:27.200Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3950","https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-truncation-via-commit-count","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-p538-c434-8v24"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"PYSEC-2026-3950","url":"https://osv.dev/vulnerability/PYSEC-2026-3950"},{"source":"nvd","source_id":"CVE-2026-73621","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73621"}],"summary":"GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to 'git rev-list' without the check_unsafe_options guard present in"}