Security Advisory
CVE-2026-73619
6.5
MEDIUM
Vulnerability Description
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.
Published Date
August 13, 2026
Official Source
NIST NVD Advisory