CVE-2026-73623
Received Received - Intake

GitPython Arbitrary Command Execution via Unsafe Git Clone Options

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73623
EUVD
EUVD-2026-57792

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitpython_developers gitpython to 3.1.54 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitPython before 3.1.54 has an incomplete denylist for unsafe Git clone options that omits the --template option. Attackers can use --template to point to a directory containing malicious post-checkout hooks. When a victim clones a repository, these hooks execute, allowing arbitrary command execution.

Detection Guidance

Check GitPython version with pip show GitPython. If version is <= 3.1.53, the system is vulnerable. Inspect Git clone commands for use of --template option in scripts or logs.

Impact Analysis

If you use GitPython versions before 3.1.54, an attacker could trick you into cloning a malicious repository. This could lead to arbitrary code execution on your system, potentially compromising your data, installing malware, or taking control of your machine.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's security rules. Organizations may face fines or legal consequences if exploited due to inadequate safeguards against command injection.

Mitigation Strategies

Upgrade GitPython to version 3.1.54 or later immediately. Review and update any scripts using git clone to ensure --template is not used. Monitor for suspicious post-checkout hooks in cloned repositories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart