CVE-2026-73621

CVE-2026-73621 is an argument injection flaw (CWE-88) in GitPython before 3.1.56: the Commit.count() method forwards keyword arguments straight to 'git rev-list' without the check_unsafe_options guard applied by its sibling iter_items method. An attacker who can influence the options passed to Commit.count() — for example, when an application forwards a user-supplied options dictionary — can inject an output=<path> option, causing 'git rev-list --output=<path>' to open and truncate the target file to zero bytes before revision parsing. The attacker gains destruction of an arbitrary file (blanked to 0 bytes) with the privileges of the process running GitPython, but cannot control file contents and there is no confidentiality impact. Any deployment of GitPython before 3.1.56 in which user-controlled option dictionaries reach Commit.count() is affected; the flaw is rated 5.3 (Medium) under CVSS 4.0. Exploitation has not been observed in the wild: the flaw is absent from CISA KEV, carries a low EPSS probability of 0.2% (11th percentile), and the only public reference is the upstream advisory GHSA-p538-c434-8v24.

What to do: Upgrade to GitPython 3.1.56 or later. As an interim mitigation, audit call sites of Commit.count() and do not pass user-controlled dictionaries as options — validate and whitelist allowed keys (blocking 'output' and other option-like values) or build arguments server-side. Prioritize review of applications where untrusted input can reach Commit.count(), since any truncated file is zeroed with the privileges of the process running GitPython.