Executive brief
GitPython is a widely-used Python library for interacting with Git repositories. The Commit.count() method contains a flaw that allows attackers who can control the options passed to this method to truncate arbitrary files to zero bytes on the system. This could be exploited by applications that forward user-supplied options to GitPython, potentially destroying critical data or disrupting operations.
Technical details
The vulnerability is an argument injection flaw (CWE-88) in the Commit.count() method, which forwards keyword arguments directly to the git rev-list command without applying the check_unsafe_options guard that exists in the sibling iter_items() method. An attacker who can control the kwargs passed to count() can inject output=<path>, causing git rev-list --output=<path> to open and truncate the target file to zero bytes before revision parsing. The attack requires the ability to influence options passed to Commit.count() (e.g., via an application that forwards a user-supplied options dict), and results in 0-byte file truncation at the process's privilege level with no content control. The fix is available in GitPython 3.1.56 and later.
Affected products
- GitPython GitPython before 3.1.56
Timeline
- 2026-07-25: disclosed
- 2026-08-13: advisory
- 2026: patched: Version 3.1.56 and later contain the fix