Is CVE-2026-73619 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-73619?

CVE-2026-73619 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-73619

Description

GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.