CVE-2026-73623 gitpython-developers CVE debrief

Who should care

Developers and administrators using GitPython in their applications or infrastructure should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 3.1.54 or later, restricting git clone operations to trusted repositories, and monitoring for suspicious activity. Additionally, security teams and vulnerability management teams should review the affected systems and assess the risk to their organization.

Technical summary

CVE-2026-73623 is a high-severity vulnerability in GitPython, a Python library used to interact with Git repositories. The vulnerability is caused by an incomplete denylist in the unsafe_git_clone_options function, which allows attackers to execute arbitrary commands during clone operations. An attacker can exploit this vulnerability by supplying the --template option pointing to a directory containing malicious post-checkout hooks. This vulnerability has a CVSS score of 7.7 and is considered high severity. Affected users should prioritize patching to prevent potential code execution during clone operations.

Defensive priority

GitPython users should prioritize patching to prevent potential code execution during clone operations.

Recommended defensive actions

• Update GitPython to version 3.1.54 or later
• Restrict git clone operations to trusted repositories
• Monitor git clone operations for suspicious activity
• Consider implementing additional security controls for GitPython usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE description indicates that GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options, allowing attackers to achieve arbitrary command execution during clone operations via the --template option. However, details about affected versions and potential mitigations are limited in the provided source corpus. Further verification is needed to confirm the scope of affected systems and to assess the effectiveness of mitigations.

Official resources