CVE-2026-73619 affects GitPython prior to version 3.1.57. The vulnerability arises because the denylist protecting the unsafe_git_archive_options in the Repo.archive() method does not include the --add-file and --add-virtual-file options. An attacker with at least low privileges can exploit this by passing these options to read arbitrary files from the filesystem and include them in the archive output. The CVSS 4.0 score is 7.1, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required beyond low, no user interaction, and high impact on confidentiality.

An attacker can read arbitrary files on the filesystem by exploiting the incomplete denylist in the unsafe_git_archive_options guard. This can lead to unauthorized disclosure of sensitive information included in the archive generated by Repo.archive(). There is no indication of privilege escalation, integrity, or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted input with the Repo.archive() method or restrict usage to trusted users only.