{"id":"CVE-2026-73625","title":"gitpython: GitPython: Remote Code Execution via kwarg value smuggling (CVE-2026-73625)","summary":"A flaw was found in GitPython. Attackers can bypass the `check_unsafe_options` guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to vari…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-78","vendor":"Red Hat","product":"Red Hat Satellite 6.16 for RHEL 8","affected":["exploit_intelligence","ai_inference_server","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","satellite 6","satellite_6_16_for_rhel 8","satellite_6_16_for_rhel 9","satellite_6_17_for_rhel 9","satellite_6_19_for_rhel 9","ansible_automation_platform 2.5","ansible_automation_platform 2.6","ansible_automation_platform 2.7","openshift_ai 2.25","openshift_ai 3.4","satellite 6.18","satellite 6.19"],"patched":["satellite_6_16_for_rhel 8","satellite_6_16_for_rhel 9","satellite_6_17_for_rhel 9","satellite_6_19_for_rhel 9","ansible_automation_platform 2.5","ansible_automation_platform 2.6","ansible_automation_platform 2.7","openshift_ai 2.25","openshift_ai 3.4","satellite 6.18","satellite 6.19"],"published":"2026-08-13","updated":"2026-10-19","sourceUpdated":"2026-10-19T11:27:19+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73625.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73625.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-73625"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515272"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73625"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73625"},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling"},{"url":"https://access.redhat.com/errata/RHSA-2026:74506"},{"url":"https://access.redhat.com/errata/RHSA-2026:74505"},{"url":"https://access.redhat.com/errata/RHSA-2026:63385"},{"url":"https://access.redhat.com/errata/RHSA-2026:71210"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179"},{"url":"https://access.redhat.com/errata/RHSA-2026:67279"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"url":"https://access.redhat.com/errata/RHSA-2026:68764"},{"url":"https://access.redhat.com/errata/RHSA-2026:68771"},{"url":"https://access.redhat.com/errata/RHSA-2026:68780"},{"url":"https://access.redhat.com/errata/RHSA-2026:68776"},{"url":"https://github.com/gitpython-developers/GitPython/pull/2180"},{"url":"https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453"},{"url":"https://github.com/gitpython-developers/GitPython"},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"}],"tags":["csaf","vex","red-hat","cve.org","osv","pip"],"epss":0.00923,"epssPercentile":0.60176,"aliases":["GHSA-r9mr-m37c-5fr3"],"ecosystem":"pip","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-08-14T18:59:31.107376Z"},"ingestedAt":"2026-08-14T19:18:45.662Z","slug":"CVE-2026-73625","body":"## Overview\n\nA flaw was found in GitPython. Attackers can bypass the `check_unsafe_options` guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as `clone_from` or `fetch`, leading to arbitrary code execution.\n\n## Vendor advisories\n\n- **RHSA-2026:74506** · Red Hat · fixed in: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74506)\n- **RHSA-2026:74505** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-10-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:74505)\n- **RHSA-2026:63385** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63385)\n- **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210)\n- **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179)\n- **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n- **RHSA-2026:68764** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68764)\n- **RHSA-2026:68771** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68771)\n- **RHSA-2026:68780** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68780)\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat Satellite 6 · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Exploit Intelligence, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73625.json)\n- **RHSA-2026:68776** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68776)\n\n**gitpython: GitPython: Remote Code Execution via kwarg value smuggling** — rated Important by Red Hat. Released 2026-08-13, updated 2026-10-19.\n\nAffected:\n\n- Exploit Intelligence\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n\nFixed:\n\n- Red Hat Satellite 6.16 for RHEL 8\n- Red Hat Satellite 6.16 for RHEL 9\n- Red Hat Satellite 6.17 for RHEL 9\n- Red Hat Satellite 6.19 for RHEL 9\n- Red Hat Ansible Automation Platform 2.5\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.4\n- Red Hat Satellite 6.18\n- Red Hat Satellite 6.19\n\nNo fix planned:\n\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Exploit Intelligence\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat Satellite 6\n\nNot affected:\n\n- Red Hat Satellite 6.19 for RHEL 9\n- Red Hat Ansible Automation Platform 2.5\n- Red Hat Ansible Automation Platform 2.6\n- Red Hat Ansible Automation Platform 2.7\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift AI 3.4\n- Migration Toolkit for Applications 8\n- Pen Drive Powered by Red Hat Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Hardened Images\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.16/html/updating_red_hat_satellite/index\n\nRelease Notes:\n\nProvisioning tokens are now required for all Operating System entries with Redhat family set. Attempts to download a unattended template without valid token will lead to “a provisioning token is required but a valid one was not provided” error.\n\nThis changed behavior will lead to inability to use Gener… https://access.redhat.com/errata/RHSA-2026:74506\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:74505\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:63385\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-73625)\n\nAffected packages:\n\n- `gitpython < 3.1.54`\n\nPatched in:\n\n- `gitpython 3.1.54`\n\nSource: https://osv.dev/vulnerability/GHSA-r9mr-m37c-5fr3","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}