Logo
›
›vulnerability›CVE-2026-73625
Name
CVE-2026-73625
Source
NVD ( link)Debian ( link)
Description
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.
CWEs
CWE-78
Published Date
Updated Date
Workaround
-
Advisories
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3Exploit
https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smugglingThird Party Advisory

Analysis#

Affected Component
Analysis
python3-git
Exploitable

Vulnerability Ratings#

8.7
CVSSv4
8.8
CVSSv31
NaN
other

Others affected component#

Name
Project
Project Version
Version
Status
python3-git
yocto
master
3.2.0
Not Affected