CVE-2026-73625

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3	Exploit Vendor Advisory
https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de GitPython anteriores a la 3.1.54 contienen una vulnerabilidad de ejecución remota de código en la protección check_unsafe_options que puede ser eludida mediante el contrabando de opciones de git dentro de valores de argumentos de palabra clave de un solo carácter. Los atacantes pueden proporcionar diccionarios de opciones manipulados a los métodos clone_from, fetch, pull, push, ls_remote, iter_commits, blame o archive para ejecutar comandos arbitrarios del sistema operativo a través del parámetro --upload-pack.

Information

Published : 2026-08-13 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73625

Mitre link : CVE-2026-73625

CVE.ORG link : CVE-2026-73625

JSON object : View

Products Affected

gitpython_project

gitpython

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-73625", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73625", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-14T18:59:31.107376Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "gitpython-developers", "product": "GitPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.1.54", "versionType": "semver"}, {"status": "unaffected", "version": "3.1.54", "versionType": "semver"}], "packageURL": "pkg:pypi/GitPython", "defaultStatus": "unaffected"}]}], "published": "2026-08-13T12:17:27.753", "references": [{"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3", "tags": ["Exploit", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter."}, {"lang": "es", "value": "Las versiones de GitPython anteriores a la 3.1.54 contienen una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en la protecci\u00f3n check_unsafe_options que puede ser eludida mediante el contrabando de opciones de git dentro de valores de argumentos de palabra clave de un solo car\u00e1cter. Los atacantes pueden proporcionar diccionarios de opciones manipulados a los m\u00e9todos clone_from, fetch, pull, push, ls_remote, iter_commits, blame o archive para ejecutar comandos arbitrarios del sistema operativo a trav\u00e9s del par\u00e1metro --upload-pack."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "AA984FF5-10CD-45B3-A5DE-FCFE2D3204E3", "versionEndExcluding": "3.1.54"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}