{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.1.55"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "GitPython"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.1.56"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-03T20:23:17Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n`Commit.count()` forwards `**kwargs` into `rev_list` with **no** `check_unsafe_options` guard (the guard exists only in the sibling `iter_items`, commit.py:341). `git rev-list --output=\u003cpath\u003e` opens and truncates the target file to 0 bytes before revision parsing, so `count(output=\u0027/victim\u0027)` destroys/blanks an arbitrary file.\n\n## Root Cause\n`commit.py:290-291` calls `self.repo.git.rev_list(self.hexsha, **kwargs)` with no `check_unsafe_options` and no `allow_unsafe_options` parameter. The sibling `iter_items` (commit.py:341) is guarded; `count` is not. This is a distinct, uncovered sink \u2014 GHSA-956x-8gvw-wg5v fixed `iter_commits`/`blame`, not `count`.\n\n## Impact\nDestroy/blank an arbitrary file at process privilege (integrity/availability). Reachability is key-control only (`count` uses `self.hexsha`, not a user ref), and the write is a 0-byte truncation (no content control), so MEDIUM.\n\n## Proof of Concept\n```python\ncommit.count(output=\u0027/path/to/victim\u0027)   # victim truncated to 0 bytes (verified)\n# control: commit.iter_commits(output=...) raises UnsafeOptionError\n```\n\n## Attack Chain\n1. Entry: app forwards user options -\u003e `commit.count(output=\u0027/victim\u0027)`. Guard: none. Bypass proof: `iter_commits(output=)` raises UnsafeOptionError; `count(output=)` does not \u2014 verified side-by-side.\n2. Sink: `git rev-list \u003csha\u003e --output=/victim` -\u003e file truncated to 0 bytes. Impact: destroy/blank arbitrary file.\n\n## Bypass Evidence\nLive-verified on HEAD (tag 3.1.53): `count(output=\u003cvictim\u003e)` truncated a pre-existing file to 0 bytes; guarded `iter_commits(output=)` raised UnsafeOptionError. Same CNA-accepted \"app forwards user options dict\" model as GHSA-956x-8gvw-wg5v\u0027s `archive(**kwargs)`. Uncovered sink, not a duplicate.\n\n## Affected Versions\n`\u003c= 3.1.53`\n\n## Suggested Fix\nAdd `check_unsafe_options` to `Commit.count` (mirroring `iter_items`).\n\n---\nReported by **zx (Jace)** \u2014 GitHub: @manus-use",
  "id": "GHSA-p538-c434-8v24",
  "modified": "2026-08-03T20:23:18Z",
  "published": "2026-08-03T20:23:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-p538-c434-8v24"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gitpython-developers/GitPython/pull/2184"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gitpython-developers/GitPython"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gitpython-developers/GitPython/releases/tag/3.1.56"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count"
}