Is CVE-2026-73625 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73625 being exploited in the wild.

How severe is CVE-2026-73625?

High severity, with a CVSS score of 8.8, published 13 August 2026.

Which products and versions are affected?

gitpython (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.54.

Is there a fix for CVE-2026-73625?

Yes. gitpython (PyPI): upgrade to 3.1.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73625 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-73625?

Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73625: GitPython remote code execution in option guard bypass

CVE-2026-73625 · Severity: high · CVSS 8.8 · Published 2026-08-13

GitPython is a popular library that applications use to interact with Git repositories programmatically. A vulnerability in its safety checks allows attackers to bypass security controls and execute arbitrary commands on the host system by smuggling malicious Git options into method parameters. This can lead to complete system compromise if an application accepts user input for Git operations.

Technologies: Gitpython Project Gitpython, gitpython (PyPI). Vendors: Gitpython Project, PyPI.

Quick answers

Is CVE-2026-73625 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73625 being exploited in the wild.
How severe is CVE-2026-73625?: High severity, with a CVSS score of 8.8, published 13 August 2026.
Which products and versions are affected?: gitpython (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.54.
Is there a fix for CVE-2026-73625?: Yes. gitpython (PyPI): upgrade to 3.1.54 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73625 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-73625?: Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gitpython (PyPI): upgrade to 3.1.54 or later
```
pip install "gitpython>=3.1.54"
```

Technical details

GitPython contains an OS command injection vulnerability (CWE-78) in the check_unsafe_options guard, which is designed to prevent dangerous Git options from being passed to Git commands. The guard only inspects kwarg keys but fails to validate kwarg values. Attackers can smuggle a dangerous Git option like --upload-pack into a single-character kwarg value; when transformed into argv tokens, the smuggled option becomes a separate token that the guard never inspected. The vulnerability is exploitable by calling affected methods (clone_from, fetch, pull, push, ls_remote, iter_commits, blame, archive) with crafted options, requiring low privileges and no user interaction. Arbitrary OS command execution is achieved via the --upload-pack parameter. The vulnerability is patched in GitPython 3.1.54 and later.

Affected products

GitPython GitPython < 3.1.54

Identifiers

CVE-2026-73625
GHSA-r9mr-m37c-5fr3
PYSEC-2026-3953

Timeline

2026-07-22: disclosed
2026-08-13: advisory
2026: patched: Fixed in version 3.1.54

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.