GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr Exploit, Vendor Advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.1 · gitpython_projectNVD modified 2026-10-23 18:10
Affected (CPE criteria) 1
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*
References 3
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr Exploit, Vendor Advisory
- https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-archive Third Party Advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr Exploit, Vendor Advisory