The vulnerability resides in GitPython versions prior to 3.1.56, where the Commit.count() method forwards user-controlled keyword arguments directly to the underlying 'git rev-list' command without applying the safety guard that the related iter_items method uses. An attacker who can supply a custom options dictionary—such as an application that passes user data to Commit.count—may include the option output=<path>. This causes the invoked git command to open the specified file and truncate it to zero bytes before any revision parsing occurs. Consequently, an arbitrary file located anywhere in the process’s file system can be destroyed or blanked, affecting confidentiality and integrity of data at the level of the running process."

The affected software is GitPython distributed by the gitpython-developers community. Vulnerable before version 3.1.56; all earlier releases are impacted. Subsequent versions, starting with 3.1.56, have the safety guard added and are not affected.

The CVSS score of 5.3 rates the vulnerability as moderate in severity. No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. The likely attack vector is local or remote code execution within an application that uses GitPython and passes unchecked options to Commit.count. Without privilege escalation, the damage is limited to files that the process can overwrite, but the absence of content control means a 0-byte truncation can cause significant data loss or application failure.