Loading vulnerability…
Argument Injection in GitPython Commit.count() Allows Arbitrary File Truncation
GitPython versions before 3.1.56 contain an argument injection vulnerability in Commit.count(). The method forwards keyword arguments to git rev-list without applying the check_unsafe_options guard used by the sibling iter_items method. An attacker controlling these arguments can inject an output option that causes Git to open and truncate a selected file to zero bytes before revision parsing. The operation is limited by the affected process's filesystem permissions and does not provide control over file contents.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation destroys the existing contents of an attacker-selected file by truncating it to zero bytes. Depending on the file and the application's privileges, this can cause data loss, application failures, or denial of service. This vulnerability does not itself provide arbitrary content writes, information disclosure, or code execution.
If you can’t patch tonight, do this now.
Do not pass untrusted dictionaries or user-controlled values as Commit.count() keyword arguments. Allowlist only the specific revision-count parameters required by the application and reject option-like values that can alter Git output handling. Run GitPython workloads with least-privilege filesystem permissions and isolate CI/CD jobs so the executing identity cannot write sensitive host files.
Patch, then assume compromise.
Upgrade GitPython to version 3.1.56 or later. For distribution-managed installations, apply the vendor security update for the affected GitPython package.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.