Is CVE-2026-73623 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73623 being exploited in the wild.

How severe is CVE-2026-73623?

High severity, with a CVSS score of 7.5, published 13 August 2026.

Which products and versions are affected?

gitpython (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.54.

Is there a fix for CVE-2026-73623?

Yes. gitpython (PyPI): upgrade to 3.1.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73623 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73623?

Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73623: GitPython unsafe_git_clone_options incomplete denylist in --template

CVE-2026-73623 · Severity: high · CVSS 7.5 · Published 2026-08-13

GitPython is a Python library used by developers to interact with Git repositories programmatically. A flaw in its clone functionality allows attackers to execute arbitrary commands on systems that use GitPython to clone untrusted repositories. An attacker can exploit this by providing a specially crafted --template parameter pointing to a directory with malicious Git hooks that execute during the clone process, potentially compromising the integrity of systems relying on this library.

Technologies: Gitpython Project Gitpython, gitpython (PyPI). Vendors: Gitpython Project, PyPI.

Quick answers

Is CVE-2026-73623 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73623 being exploited in the wild.
How severe is CVE-2026-73623?: High severity, with a CVSS score of 7.5, published 13 August 2026.
Which products and versions are affected?: gitpython (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.54.
Is there a fix for CVE-2026-73623?: Yes. gitpython (PyPI): upgrade to 3.1.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73623 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73623?: Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gitpython (PyPI): upgrade to 3.1.54 or later
```
pip install "gitpython>=3.1.54"
```

Technical details

GitPython versions before 3.1.54 fail to properly validate the --template parameter in the unsafe_git_clone_options denylist within base.py (lines 145-152). The --template option in git clone copies hook files from a specified directory into the new repository and executes them (specifically the post-checkout hook) during checkout. An attacker with control over clone parameters can bypass the incomplete denylist by supplying --template pointing to an attacker-controlled or world-writable directory containing a malicious post-checkout hook. The vulnerability requires an attacker-readable directory with executable hooks, a realistic precondition on shared filesystems, upload directories, /tmp, or network paths. The fix involves adding --template to the unsafe_git_clone_options denylist and auditing for other hook/exec-influencing options. Patched in version 3.1.54.

Affected products

GitPython GitPython before 3.1.54

Identifiers

CVE-2026-73623
GHSA-6p8h-3wgx-97gf
PYSEC-2026-3952

Timeline

2026-07-22: disclosed: GitHub Security Advisory GHSA-6p8h-3wgx-97gf published
2026-08-13: advisory: CVE-2026-73623 published on NVD
2026: patched: Fixed in GitPython 3.1.54

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.