GHSA-p538-c434-8v24: Medium severity pip/GitPython vulnerability
Summary Commit.count() forwards kwargs into revlist with no checkunsafeoptions guard (the guard exists only in the sibling iteritems, commit.py:341). git rev-list --output=<path> opens and truncates the target file to 0 bytes before revision parsing, so count(output='/victim') destroys/blanks an arbitrary file.
Root Cause commit.py:290-291 calls self.repo.git.revlist(self.hexsha, kwargs) with no checkunsafeoptions and no allowunsafeoptions parameter. The sibling iteritems (commit.py:341) is guarded; count is not. This is a distinct, uncovered sink — GHSA-956x-8gvw-wg5v fixed itercommits/blame, not count.
Impact Destroy/blank an arbitrary file at process privilege (integrity/availability). Reachability is key-control only (count uses self.hexsha, not a user ref), and the write is a 0-byte truncation (no content control), so MEDIUM.
Proof of Concept python commit.count(output='/path/to/victim') # victim truncated to 0 bytes (verified) control: commit.itercommits(output=...) raises UnsafeOptionError
Attack Chain 1. Entry: app forwards user options -> commit.count(output='/victim'). Guard: none. Bypass proof: itercommits(output=) raises UnsafeOptionError; count(output=) does not — verified side-by-side. 2. Sink: git rev-list <sha> --output=/victim -> file truncated to 0 bytes. Impact: destroy/blank arbitrary file.
Bypass Evidence Live-verified on HEAD (tag 3.1.53): count(output=<victim>) truncated a pre-existing file to 0 bytes; guarded itercommits(output=) raised UnsafeOptionError. Same CNA-accepted "app forwards user options dict" model as GHSA-956x-8gvw-wg5v's archive(kwargs). Uncovered sink, not a duplicate.
Affected Versions <= 3.1.53
Suggested Fix Add checkunsafeoptions to Commit.count (mirroring iteritems).
--- Reported by zx (Jace) — GitHub: @manus-use
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/GitPythonto a version that resolves this vulnerability.Fixed in 3.1.56 - Upgrade
Upgrade
(commit.py / Commit.count / rev_list sink)to a version that resolves this vulnerability.Fixed in <= 3.1.53 - Configuration
Add `check_unsafe_options` to `Commit.count` so that user-supplied options forwarded into `self.repo.git.rev_list(self.hexsha, **kwargs)` (notably `output=<path>`) are validated/blocked, mirroring the existing guard used in the sibling `iter_items`/`iter_commits(output=...)` path.
Commit.count (commit.py) / git rev-list invocation check_unsafe_options guard for output=<path> passed via **kwargs = enabled
Event History
Frequently Asked Questions
What is the severity of GHSA-p538-c434-8v24?
The severity of GHSA-p538-c434-8v24 is classified as medium with a score of 5.4.
How do I fix GHSA-p538-c434-8v24?
To fix GHSA-p538-c434-8v24, ensure you are using an updated version of GitPython that addresses this vulnerability.
What impact does GHSA-p538-c434-8v24 have on my system?
GHSA-p538-c434-8v24 could lead to unexpected file truncation due to unsafe handling of output parameters.
Which versions of GitPython are affected by GHSA-p538-c434-8v24?
Versions of GitPython prior to the fix related to GHSA-p538-c434-8v24 are affected.
What are the steps involved in exploiting GHSA-p538-c434-8v24?
Exploitation of GHSA-p538-c434-8v24 involves manipulating the `Commit.count()` method to pass unsafe output parameters.