CVE-2026-73625High· 8.8▾ TwilightA flaw was found in GitPython. Attackers can bypass the `check_unsafe_options` guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to vari…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Aug 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
0.5% → 0.9%
Last analysed / modified upstream
A flaw was found in GitPython. Attackers can bypass the check_unsafe_options guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as clone_from or fetch, leading to arbitrary code execution.
gitpython: GitPython: Remote Code Execution via kwarg value smuggling — rated Important by Red Hat. Released 2026-08-13, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For detailed instructions how to apply this update, refer to:
Release Notes:
Provisioning tokens are now required for all Operating System entries with Redhat family set. Attempts to download a unattended template without valid token will lead to “a provisioning token is required but a valid one was not provided” error.
This changed behavior will lead to inability to use Gener… https://access.redhat.com/errata/RHSA-2026:74506 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:74505 Before applying this update, make sure all previously released errata relevant to your system have been applied.
For detailed instructions how to apply this update, refer to:
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:63385
Workarounds / mitigations:
Affected packages:
gitpython < 3.1.54Patched in:
gitpython 3.1.54Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73623High· 7.5gitpython: GitPython: Remote Code Execution via malicious Git template (CVE-2026-73623)
CVE-2026-73622High· 7.5gitpython: GitPython: Information disclosure via environment variable expansion in URL handling (CVE-2026-73622)
CVE-2026-73620High· 8.8gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding (CVE-2026-73620)
CVE-2026-42284High· 7.5GitPython: GitPython: Arbitrary code execution via improper validation of clone options (CVE-2026-42284)
CVE-2026-42215High· 7.5GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks (CVE-2026-42215)
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)