What is CVE-2026-73619?
This vulnerability arises from an incomplete denylist in the unsafe_git_archive_options guard in GitPython versions prior to 3.1.57. Attackers can exploit this by supplying --add-file and --add-virtual-file options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive. Immediately upgrading GitPython to the latest version is strongly recommended.
Azərbaycanca: Bu boşluq GitPython 3.1.57 öncəsi versiyalarda unsafe_git_archive_options qoruyucu filterindəki natamam bloklama siyahısından (incomplete denylist) qaynaqlanır. Təcavüzkarlar Repo.archive() funksiyasına --add-file v* --add-virtual-file seçimlərini ötürərək fayl sistemindən ixtiyari faylları oxuyub arxivə daxil edə bilərlər. Təsirə məruz qalan sistemlərdə dərhal GitPython kitabxanasını ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
What is the CVE-2026-73619 vulnerability?
This is a security vulnerability in GitPython versions prior to 3.1.57 caused by an incomplete denylist in the `unsafe_git_archive_options` guard. Attackers can supply `--add-file` and `--add-virtual-file` options to `Repo.archive()` to read arbitrary files from the filesystem and include them in the returned archive.
How to protect against CVE-2026-73619?
It is strongly recommended to immediately upgrade the GitPython library to the latest version on affected systems.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.