CVE-2026-73623CWE-78command-injection

CVE-2026-73623

High · published August 13, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
57.3
In the wild
Unconfirmed
What it is

GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00835 · 57.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-13T16:17Z
Affected products (1)
ProductVersionsFixed in
gitpython_project/gitpython< 3.1.543.1.54
References (3)
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf · [email protected]https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template · [email protected]https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 11:28Z
    GitPython before 3.1.54 Remote Code Execution via --template
    cvelistv5