CVE-2026-73619
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Aug 13, 2026
Vendor
unknown
Description
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.