CVE-2026-73623

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
gitpython-developers	GitPython	< 3.1.54

References

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gfExploit, Vendor Advisory
https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-templateThird Party Advisory
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gfExploit, Vendor Advisory

Timeline

Published: Aug 13, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-736248.1GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git op CVE-2026-736258.8GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smu CVE-2026-736267.5JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing CVE-2026-736276.0JupyterLab (pip package 'jupyterlab') versions >=4.1.0,<=4.5.9 and >=4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Tw CVE-2026-736286.1Serendipity versions >= 2.3.5 and <= 2.6.0 contain a reflected cross-site scripting vulnerability in the search clean-URL route (/search/<te CVE-2026-736298.5Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipity_url_allowed() filter that fails to block he CVE-2026-73638.8Use after free in Canvas in Google Chrome on Linux, ChromeOS prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code ins CVE-2026-736305.8SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is register CVE-2026-736314.3Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-request parsing state could be shared acros CVE-2026-736324.3Exposure of data element to wrong session vulnerability in the JSON plugin of Apache Struts. Per-response serialization state could be share CVE-2026-736337.5Uncontrolled resource consumption vulnerability in the JSON plugin of Apache Struts. When an application is configured to populate actions f CVE-2026-736347.5Uncontrolled resource consumption vulnerability in Apache Struts. An application that exposes an endpoint collecting Content Security Policy