CVE-2026-73621

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.56

Description An argument injection issue exists in the Commit.count() method, which forwards keyword arguments to git rev-list without utilizing the check unsafe options guard. An attacker capable of controlling the options passed to Commit.count() can provide the output variable with a specific file path. This causes the system to execute git rev-list --output=<path>, which opens and truncates the target file to zero bytes, resulting in the destruction of an arbitrary file at the privilege level of the process.

Recommendations Update GitPython to version 3.1.56 or later. As a temporary mitigation, restrict or validate any user-supplied options passed to the Commit.count() method.