Vulnerability - CVE-2026-73619

›

›vulnerability›CVE-2026-73619

Name

CVE-2026-73619

Source

NVD ( link)Debian ( link)

Description

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.

CWEs

Published Date

Aug 13, 2026

Updated Date

Sep 3, 2026

Workaround

-

Advisories

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rrExploit

https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-archiveThird Party Advisory

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rrExploit

Analysis#

Affected Component

Analysis

Vulnerability Ratings#

7.1

CVSSv4

6.5

CVSSv31

NaN

other

Others affected component#

Name

Project

Project Version

Version

Status

yocto

master

3.2.0

Not Affected