VDB
GHSA-539m-9xh6-q6rr
GHSA-539m-9xh6-q6rr
PUBLISHED
CVSS 6.5 MEDIUM
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | GitPython | 0 |
| chainguard | awx | 0, 0, 0 |
| chainguard | jupyter-all-spark-notebook | 0, 0, 0 |
| wolfi | mlflow | 0 |
| chainguard | mlflow | 0 |
| PyPI | GitPython |
Timeline
- Aug 3, 2026 CVE Published
References
- https://github.com/advisories/GHSA-539m-9xh6-q6rr advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr url
- https://github.com/gitpython-developers/GitPython/pull/2193 patch
- https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca patch
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57 url
- https://github.com/gitpython-developers/GitPython package