THREAT OPS › Threat News › [GHSA] GHSA-539m-9xh6-q6rr (medium) — GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
[GHSA] GHSA-539m-9xh6-q6rr (medium) — GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
GHSA-539m-9xh6-q6rr Severity: medium CVE: None
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
**Target:** gitpython-developers/GitPython **Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version 2.50.1`
## Summary
`Repo.archive()` does call the option guard, so this is not a mi
MITRE ATT&CK techniques
- CompressionT1027.015
Indicators of compromise
- http://169.254.169.254/latest/meta-data/url
Original source: https://github.com/advisories/GHSA-539m-9xh6-q6rr