new file mode 100644
@@ -0,0 +1,72 @@
+From 3186ded297a9818f887c3de47fc2f0aba6a8b298 Mon Sep 17 00:00:00 2001
+From: Sebastian Thiel <sebastian.thiel@icloud.com>
+Date: Sat, 25 Jul 2026 06:27:01 +0200
+Subject: [PATCH] fix: reject unsafe output options in Commit.count
+
+<!-- agent -->
+
+Commit.count forwards keyword arguments to git rev-list but did not apply the
+unsafe-option validation used by the sibling revision APIs.
+
+Validate forwarded options with the existing Git.check_unsafe_options helper
+and retain the explicit allow_unsafe_options escape hatch. This covers
+GHSA-p538-c434-8v24 without adding another option parser.
+
+Git baseline: git.git a23bace963 defines --output as a shared diff option
+consumed by setup_revisions; t/t6000-rev-list-misc.sh exercises that option
+with rev-list.
+
+CVE: CVE-2026-73621
+Upstream-Status: Backport [https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2]
+
+Backport Changes:
+- Omitted test/test_commit.py because the current PyPI source
+ archive does not include the test suite and the python3-git
+ recipe does not run it.
+
+Co-authored-by: GPT 5.6 <codex@openai.com>
+(cherry picked from commit 38553b6fddc7f6a667cdb45a6762343a08fc72b2)
+Signed-off-by: Yogita Urade <yurade@cisco.com>
+---
+ git/objects/commit.py | 15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/git/objects/commit.py b/git/objects/commit.py
+index cc85e7dd..549e12c7 100644
+--- a/git/objects/commit.py
++++ b/git/objects/commit.py
+@@ -269,13 +269,21 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable):
+ else:
+ return self.message.split(b"\n", 1)[0]
+
+- def count(self, paths: Union[PathLike, Sequence[PathLike]] = "", **kwargs: Any) -> int:
++ def count(
++ self,
++ paths: Union[PathLike, Sequence[PathLike]] = "",
++ allow_unsafe_options: bool = False,
++ **kwargs: Any,
++ ) -> int:
+ """Count the number of commits reachable from this commit.
+
+ :param paths:
+ An optional path or a list of paths restricting the return value to commits
+ actually containing the paths.
+
++ :param allow_unsafe_options:
++ Allow unsafe options, like ``--output``.
++
+ :param kwargs:
+ Additional options to be passed to :manpage:`git-rev-list(1)`. They must not
+ alter the output style of the command, or parsing will yield incorrect
+@@ -284,6 +292,11 @@ class Commit(base.Object, TraversableIterableObj, Diffable, Serializable):
+ :return:
+ An int defining the number of reachable commits
+ """
++ if not allow_unsafe_options:
++ Git.check_unsafe_options(
++ options=Git._option_candidates([], kwargs), unsafe_options=self.unsafe_git_rev_options
++ )
++
+ # Yes, it makes a difference whether empty paths are given or not in our case as
+ # the empty paths version will ignore merge commits for some reason.
+ if paths:
@@ -32,6 +32,7 @@ SRC_URI += "file://CVE-2026-42284.patch \
file://CVE-2026-73623.patch \
file://CVE-2026-73624.patch \
file://CVE-2026-73622.patch \
+ file://CVE-2026-73621.patch \
"
SRC_URI[sha256sum] = "35f314a9f878467f5453cc1fee295c3e18e52f1b99f10f6cf5b1682e968a9e7c"
This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-73621 Signed-off-by: Yogita Urade <yurade@cisco.com> --- .../python/python3-git/CVE-2026-73621.patch | 72 +++++++++++++++++++ .../python/python3-git_3.1.43.bb | 1 + 2 files changed, 73 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-git/CVE-2026-73621.patch