https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:03:49 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73621 <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to &#39;git rev-list&#39; without the check_unsafe_options guard present in the sibling iter_items method. An attacker who can control options passed to Commit.count (e.g., via an application that forwards a user-supplied options dict) can supply output=&lt;path&gt;, causing &#39;git rev-list --output=&lt;path&gt;&#39; to open and truncate the target file to zero bytes before revision parsing. This allows destruction/blanking of an arbitrary file at the process&#39;s privilege level (no content control, 0-byte truncation).</p> <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython before 3.1.56 contains an argument injection vulnerability in the Commit.count() method, which forwards keyword arguments to &#39;git rev-list&#39; without the check_unsafe_options guard present in the sibling iter_items method. An attacker who can control options passed to Commit.count (e.g., via an application that forwards a user-supplied options dict) can supply output=&lt;path&gt;, causing &#39;git rev-list --output=&lt;path&gt;&#39; to open and truncate the target file to zero bytes before revision parsing. This allows destruction/blanking of an arbitrary file at the process&#39;s privilege level (no content control, 0-byte truncation).</p> https://vulnerability.circl.lu/vuln/cve-2026-73621