{"uuid": "b6767233-742a-4d98-b803-9c51ad939c26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-P538-C434-8V24", "type": "seen", "source": "https://gist.github.com/alon710/7c801d57bbc1100bfc82173b2522a257", "content": "# GHSA-P538-C434-8V24: GHSA-P538-C434-8V24: Arbitrary File Truncation via Argument Injection in GitPython Commit.count\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/GHSA-P538-C434-8V24\n\n## Summary\nGitPython prior to version 3.1.56 is vulnerable to argument injection in the Commit.count method. An attacker who controls keyword arguments passed to this method can inject arbitrary Git options, such as --output, leading to arbitrary file truncation on the host filesystem.\n\n## TL;DR\nUnsafe forwarding of keyword arguments in GitPython's Commit.count method allows remote attackers to inject command-line flags like --output, causing arbitrary files on the local filesystem to be truncated to zero bytes.\n\n## Technical Details\n\n- **CWE ID**: CWE-88 (Improper Control of Generation of Code / Argument Injection)\n- **Attack Vector**: Local/Remote parameter injection\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: N/A\n- **Impact**: Arbitrary File Truncation\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- GitPython\n- **GitPython**: < 3.1.56 (Fixed in: `3.1.56`)\n\n## Mitigation\n\n- Upgrade GitPython to version 3.1.56 or later.\n- Sanitize dictionary keys before unpacking them as keyword arguments into Commit.count.\n- Employ the principle of least privilege to run applications wrapping Git binaries.\n\n**Remediation Steps:**\n1. Identify all code locations using GitPython's Commit.count method.\n2. Update requirements.txt, setup.py, or Pipfile to pin GitPython>=3.1.56.\n3. Verify that user inputs are not directly passed to dynamic keyword parameters in library calls.\n\n## References\n\n- [Official GitHub Advisory](https://github.com/advisories/GHSA-P538-C434-8V24)\n- [Official GitPython Pull Request](https://github.com/gitpython-developers/GitPython/pull/2184)\n- [Official Patch Commit](https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2)\n- [Official Release Notes](https://github.com/gitpython-developers/GitPython/releases/tag/3.1.56)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-P538-C434-8V24) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T06:32:33.050801Z"}