GitPython EUVD-2026-57823

Exploitation requires that the attacker can control or influence the keyword arguments passed to Repo.archive() - specifically that add_file or add_virtual_file kwargs are set to attacker-controlled path values. This condition is met in web applications or CI/CD systems that expose git archive functionality with user-supplied option passthrough. The default allow_unsafe_options=False setting does NOT prevent exploitation because the guard denylist itself is incomplete; no non-default configuration is required. Exploitation is bounded by: (1) the process's OS-level read permissions on the target file (files unreadable by the git process cannot be exfiltrated), (2) GitPython version must be 3.1.56 or earlier, and (3) the Repo.archive() call path must be reachable with attacker-influenced kwargs. Applications that construct Repo.archive() kwargs entirely from hardcoded values are not exploitable regardless of version.

The CVSS 4.0 score of 7.1 with PR:L accurately reflects that exploitation is conditional on the attacker being able to influence the kwargs passed to Repo.archive() - this is not an unauthenticated network-reachable flaw in the abstract, but in web applications or API services that forward user-supplied archive options, PR:L may effectively collapse to unauthenticated from the perspective of the web application's end users. VC:H with VI:N and VA:N is consistent with a pure arbitrary file read primitive with no write or denial-of-service capability. A working POC published in the GHSA advisory significantly lowers the exploitation barrier - any developer can reproduce it. No CISA KEV listing means widespread active exploitation is not confirmed. EPSS data was not provided, so exploitation probability cannot be quantified numerically. The real-world priority is high for any Python application that passes user-influenced parameters to Repo.archive(); it is low for applications that never expose this method to untrusted input.

An attacker using a web service that accepts user-specified git archive options submits add_file=/etc/shadow as a parameter. The service calls Repo.archive() with the user-supplied kwargs, GitPython passes --add-file=/etc/shadow to git archive, and the resulting tar archive embeds the shadow file. The attacker downloads the archive, extracts it, and obtains credentials. A published POC in the GHSA advisory demonstrates this end-to-end flow with byte-for-byte verification against an out-of-tree canary file.