Skip to main content

GitPython CVE-2026-73623

| EUVDEUVD-2026-57792 HIGH
OS Command Injection (CWE-78)
2026-08-13 VulnCheck GHSA-2726-phmx-rc26
Command Injection Gitpython Red Hat Suse
7.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.7 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.5 HIGH

AV:N as clone targets remote URLs; AC:H for hook-staging precondition (AT:P equivalent); PR:L as caller must control clone arguments; S:C because hook execution escapes the library's own scope.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 13, 2026 - 13:01 EUVD
Source Code Evidence Fetched
Aug 13, 2026 - 12:38 vuln.today
Analysis Generated
Aug 13, 2026 - 12:38 vuln.today
CVE Published
Aug 13, 2026 - 11:28 cve.org
HIGH 7.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 3 pypi packages depend on gitpython (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.1.54.

DescriptionCVE.org

GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.

AnalysisAI

Arbitrary OS command execution in GitPython <= 3.1.53 is achievable during clone operations because the unsafe_git_clone_options denylist in base.py omits --template, allowing it to pass check_unsafe_options without error in the default allow_unsafe_options=False configuration. Callers who can influence Repo.clone_from() arguments can supply a --template path to an attacker-staged directory containing an executable post-checkout hook, which git automatically executes at checkout time. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Stage executable post-checkout hook in attacker-reachable directory
Delivery
Supply --template path via Repo.clone_from() template argument
Exploit
--template passes check_unsafe_options (absent from denylist)
Execution
Git copies hook directory into cloned repo's .git/hooks/
Persist
Git executes post-checkout hook at checkout time
Impact
Arbitrary OS commands run under cloning process identity
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Two concurrent conditions are required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.7 with AC:H and AT:P accurately reflects the dual precondition: the attacker must both control clone arguments (PR:L) and stage a reachable hook directory. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targeting a CI/CD service backed by GitPython stages an executable `post-checkout` hook (e.g., a reverse shell or credential harvester) in a world-readable directory such as `/tmp/evil/hooks/post-checkout`. The attacker then submits a repository job or API request that causes the service to call `Repo.clone_from(url, dest, template='/tmp/evil')` - achievable wherever the application forwards user-controlled repository metadata to clone arguments. …
Remediation Upgrade GitPython to version 3.1.54 or later via `pip install --upgrade gitpython`. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems and applications using GitPython, identify version numbers, and assess whether clone operations may process untrusted or user-controlled template arguments. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-78676 CRITICAL
9.3 Aug 25

Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67325 HIGH
8.7 Aug 01

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
CVE-2026-67323 HIGH
8.6 Aug 01

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
CVE-2026-73625 HIGH
8.7 Aug 13

Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
CVE-2026-76220 HIGH
8.7 Aug 19

Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using

CVE-2026-78677 HIGH
8.7 Aug 25

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
CVE-2026-76221 HIGH
8.7 Aug 19

Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution vi

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-73623 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy