Description

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T12:17:26.913Z",
  "pubdate": "2026-08-13T12:17:26.913Z",
  "executiveSummary": "GitPython before 3.1.57 contains an incomplete denylist vulnerability within the unsafe_git_archive_options security guard.\nThe vulnerability allows remote or local threat actors to supply specific unvalidated command-line options—specifically --add-file and --add-virtual-file—to the vulnerable Repo.archive() function.\nBy successfully passing these restricted flags, an attacker can manipulate underlying git archive operations to read arbitrary files from the host filesystem and include them directly within the generated archive output.\nThis flaw impacts all deployments utilizing affected versions of the GitPython library where untrusted input is passed to archive generation routines.\nThe primary risk implication is the unauthorized disclosure of sensitive system files, configuration data, or private source code accessible to the execution context of the Python process.\nExploitation requires the ability to invoke the vulnerable Repo.archive() method with attacker-controlled parameters, potentially posing significant risks in multi-tenant environments or web applications that process user-supplied repository options.",
  "technicalDetails": "The root cause of this vulnerability lies in an incomplete denylist implementation within the unsafe_git_archive_options validation guard of the GitPython library.\nThe vulnerable component is the Repo.archive() function, which interfaces with underlying git archive commands.\nWhile GitPython attempts to restrict dangerous command-line options from being passed to git archive, the internal denylist omits the --add-file and --add-virtual-file options.\nThese flags are native parameters supported by the git archive command that instruct the git subsystem to inject arbitrary file contents into the resulting archive payload.\nThe attack flow proceeds as follows: an attacker identifies an entry point where application input controls the options or parameters passed to the Repo.archive() method.\nThe attacker crafts a malicious payload incorporating the --add-file or --add-virtual-file options pointing to targeted sensitive file paths on the host filesystem.\nWhen GitPython constructs and executes the git archive command, the lack of sanitization for these specific flags allows them to pass through the unsafe_git_archive_options validation guard without interference.\nThe underlying git process executes with the privileges of the running Python application, reads the targeted arbitrary files from the filesystem, and serializes their contents into the returned archive object or stream.\nThe attacker subsequently retrieves the generated archive, gaining unauthorized access to confidential data.\nThis vulnerability affects GitPython versions prior to 3.1.57.\nAuthentication requirements, privilege requirements, and network exposure depend entirely on the architecture of the parent application consuming the vulnerable GitPython library, as the flaw itself is exposed through programmatic function calls rather than a standalone network service."
}