Executive brief
GitPython, a popular Python library used to interact with Git repositories, is vulnerable to a flaw that allows an attacker to delete the contents of files on the system. By providing a specially crafted input to the library's commit counting function, an attacker can force the application to overwrite any file the application has access to, potentially causing data loss or system instability. This occurs because the library fails to block dangerous command-line options when executing internal Git commands.
Technical details
The `Commit.count()` method in `commit.py` fails to implement the `check_unsafe_options` guard when forwarding keyword arguments to the underlying `git rev-list` command. This allows an attacker to inject the `--output=<path>` flag. When Git executes `rev-list` with this flag, it opens and truncates the specified file to zero bytes before processing revisions. While the attacker does not have control over the content written (it is always a 0-byte truncation), this leads to a loss of integrity and availability for arbitrary files reachable by the process. The vulnerability was addressed in version 3.1.56 by adding the missing safety checks.
Affected products
- gitpython-developers GitPython <= 3.1.55
Timeline
- 2026-07-25: disclosed: Initial report to maintainers
- 2026-08-03: advisory: GitHub Advisory published
- 2026-08-03: patched: Version 3.1.56 released