CVE-2026-73621 is an argument injection vulnerability in GitPython prior to version 3.1.56. The Commit.count() method forwards user-controllable keyword arguments directly to the 'git rev-list' command without the check_unsafe_options guard that is present in the iter_items method. An attacker able to influence the options passed to Commit.count can supply an output=<path> argument, causing 'git rev-list --output=<path>' to open and truncate the specified file to zero bytes before processing revisions. This leads to the destruction or blanking of arbitrary files with the privileges of the running process.

An attacker who can control the options passed to Commit.count() can cause arbitrary files to be truncated to zero bytes, effectively destroying their contents. This occurs at the privilege level of the process running GitPython, potentially leading to denial of service or data loss. There is no control over the content written, only truncation to zero bytes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted or user-supplied options to the Commit.count() method to prevent exploitation of this vulnerability.