GHSA-p538-c434-8v24: Medium severity pip/GitPython vulnerability

Published Aug 3, 2026
·
Updated

Summary Commit.count() forwards kwargs into revlist with no checkunsafeoptions guard (the guard exists only in the sibling iteritems, commit.py:341). git rev-list --output=<path> opens and truncates the target file to 0 bytes before revision parsing, so count(output='/victim') destroys/blanks an arbitrary file.

Root Cause commit.py:290-291 calls self.repo.git.revlist(self.hexsha, kwargs) with no checkunsafeoptions and no allowunsafeoptions parameter. The sibling iteritems (commit.py:341) is guarded; count is not. This is a distinct, uncovered sink — GHSA-956x-8gvw-wg5v fixed itercommits/blame, not count.

Impact Destroy/blank an arbitrary file at process privilege (integrity/availability). Reachability is key-control only (count uses self.hexsha, not a user ref), and the write is a 0-byte truncation (no content control), so MEDIUM.

Proof of Concept python commit.count(output='/path/to/victim') # victim truncated to 0 bytes (verified) control: commit.itercommits(output=...) raises UnsafeOptionError

Attack Chain 1. Entry: app forwards user options -> commit.count(output='/victim'). Guard: none. Bypass proof: itercommits(output=) raises UnsafeOptionError; count(output=) does not — verified side-by-side. 2. Sink: git rev-list <sha> --output=/victim -> file truncated to 0 bytes. Impact: destroy/blank arbitrary file.

Bypass Evidence Live-verified on HEAD (tag 3.1.53): count(output=<victim>) truncated a pre-existing file to 0 bytes; guarded itercommits(output=) raised UnsafeOptionError. Same CNA-accepted "app forwards user options dict" model as GHSA-956x-8gvw-wg5v's archive(kwargs). Uncovered sink, not a duplicate.

Affected Versions <= 3.1.53

Suggested Fix Add checkunsafeoptions to Commit.count (mirroring iteritems).

--- Reported by zx (Jace) — GitHub: @manus-use

Affected Software

1 affected componentFixes available
pip/GitPython<=3.1.55
3.1.56

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade pip/GitPython to a version that resolves this vulnerability.

    Fixed in 3.1.56
  2. Upgrade

    Upgrade (commit.py / Commit.count / rev_list sink) to a version that resolves this vulnerability.

    Fixed in <= 3.1.53
  3. Configuration

    Add `check_unsafe_options` to `Commit.count` so that user-supplied options forwarded into `self.repo.git.rev_list(self.hexsha, **kwargs)` (notably `output=<path>`) are validated/blocked, mirroring the existing guard used in the sibling `iter_items`/`iter_commits(output=...)` path.

    Commit.count (commit.py) / git rev-list invocation check_unsafe_options guard for output=<path> passed via **kwargs = enabled

Event History

Aug 3, 2026
Advisory Published
via GitHub·08:23 PM
Data Sourced
via GitHub·08:23 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of GHSA-p538-c434-8v24?

The severity of GHSA-p538-c434-8v24 is classified as medium with a score of 5.4.

2

How do I fix GHSA-p538-c434-8v24?

To fix GHSA-p538-c434-8v24, ensure you are using an updated version of GitPython that addresses this vulnerability.

3

What impact does GHSA-p538-c434-8v24 have on my system?

GHSA-p538-c434-8v24 could lead to unexpected file truncation due to unsafe handling of output parameters.

4

Which versions of GitPython are affected by GHSA-p538-c434-8v24?

Versions of GitPython prior to the fix related to GHSA-p538-c434-8v24 are affected.

5

What are the steps involved in exploiting GHSA-p538-c434-8v24?

Exploitation of GHSA-p538-c434-8v24 involves manipulating the `Commit.count()` method to pass unsafe output parameters.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203