Vulnerability - CVE-2026-73623

›

›vulnerability›CVE-2026-73623

Name

CVE-2026-73623

Source

NVD ( link)Debian ( link)

Description

GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.

CWEs

Published Date

Aug 13, 2026

Updated Date

Sep 3, 2026

Workaround

-

Advisories

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gfExploit

https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-templateThird Party Advisory

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gfExploit

Analysis#

Affected Component

Analysis

Vulnerability Ratings#

7.7

CVSSv4

7.5

CVSSv31

8.8

CVSSv31

NaN

other

Others affected component#

Name

Project

Project Version

Version

Status

yocto

master

3.2.0

Not Affected