Is CVE-2026-73620 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73620 being exploited in the wild.

How severe is CVE-2026-73620?

High severity, with a CVSS score of 8.1, published 13 August 2026.

Which products and versions are affected?

gitpython (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.57.

Is there a fix for CVE-2026-73620?

Yes. gitpython (PyPI): upgrade to 3.1.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73620 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73620?

Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73620: GitPython unguarded git option forwarding in IndexFile.checkout() and TagReference.create()

CVE-2026-73620 · Severity: high · CVSS 8.1 · Published 2026-08-13

GitPython is a widely-used library that enables Python applications to interact with Git repositories. The library fails to validate dangerous command-line options passed through certain methods, allowing attackers with repository access to overwrite arbitrary files on the system or read sensitive files. An attacker can commit malicious files to a repository and use specially crafted method parameters to achieve file write/read operations outside the repository directory.

Technologies: Gitpython Project Gitpython, gitpython (PyPI). Vendors: Gitpython Project, PyPI.

Quick answers

Is CVE-2026-73620 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73620 being exploited in the wild.
How severe is CVE-2026-73620?: High severity, with a CVSS score of 8.1, published 13 August 2026.
Which products and versions are affected?: gitpython (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.57.
Is there a fix for CVE-2026-73620?: Yes. gitpython (PyPI): upgrade to 3.1.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73620 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73620?: Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gitpython (PyPI): upgrade to 3.1.57 or later
```
pip install "gitpython>=3.1.57"
```

Technical details

GitPython blocks dangerous git options via Git.check_unsafe_options(), but this guard is inconsistently applied across the codebase. IndexFile.checkout() and TagReference.create() forward **kwargs directly to git commands without validation. IndexFile.checkout() forwards unguarded options to git checkout-index, allowing the --prefix flag to write repository content to arbitrary filesystem paths with full attacker control over both destination and content. TagReference.create() forwards unguarded options to git tag, allowing the -F flag to read arbitrary files and return their contents in-band via the tag message. Both require authentication (PR branch access or repository clone), but impact is high: file overwrites enable code execution via authorized_keys/.bashrc/.git/hooks injection, and arbitrary file reads expose sensitive data. Patches are available in version 3.1.57 and later.

Affected products

GitPython GitPython before 3.1.57

Identifiers

CVE-2026-73620
GHSA-3f7w-8rr8-f37f
PYSEC-2026-3949

Timeline

2026-07-26: disclosed
2026-08-13: advisory: CVE-2026-73620 published
2026-07-26: patched: Fixed in version 3.1.57

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.