CVE-2026-73625CWE-78command-injection

CVE-2026-73625

High · published August 13, 2026

CVSS v3.1

8.8

EPSS

Percentile

60.0

In the wild

Unconfirmed

What it is

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00923 · 60.0th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2026-08-13T16:17Z

Affected products (1)

Product	Versions	Fixed in
gitpython_project/gitpython	< 3.1.54	3.1.54

References (2)

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3 · [email protected]https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling · [email protected]

EPSS history

Timeline

13 AUG 11:28Z
GitPython before 3.1.54 Remote Code Execution via kwarg value smuggling
cvelistv5