CVE-2026-73623: GitPython before 3.1.54 Remote Code Execution via --template
GitPython before 3.1.54 contains an incomplete denylist in unsafegitcloneoptions that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73623?
The severity of CVE-2026-73623 is high, with a score of 7.5.
What vulnerability does CVE-2026-73623 describe?
CVE-2026-73623 describes a remote code execution vulnerability in GitPython before version 3.1.54 due to an incomplete denylist in unsafe_git_clone_options.
How do I fix CVE-2026-73623?
To fix CVE-2026-73623, upgrade to GitPython version 3.1.54 or later.
What type of attack is possible with CVE-2026-73623?
CVE-2026-73623 allows attackers to achieve arbitrary command execution during clone operations.
What options are unsafe in GitPython related to CVE-2026-73623?
The unsafe option omitted in GitPython related to CVE-2026-73623 is the --template option.