CVE-2026-73623 — GitPython before 3.1.54 Remote Code Execution via --template
GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone…
Published: 2026-08-13 · CVSS: 7.7 · CVSS 4.0
GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7