GitPython before 3.1.54 Remote Code Execution via --template
Priority HIGH 69CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 11 fixed, 6 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-78.
Summary
GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00961 61st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial GitPython (gitpython-developers): 3.1.54Red Hat: 13 advisoriesRed Hat: 11 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| gitpython-developers | GitPython | before 3.1.54 | 3.1.54 | Patch available | CNA |
- GitPython Vendorgitpython-developers Affected before 3.1.54 Fixed in 3.1.54 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* | before 3.1.54 | Vulnerable | gitpython-developers |
- cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* Versions before 3.1.54 Vulnerable ·gitpython-developers
Remediation
- Fix · CNA GitPython (gitpython-developers) Fixed in 3.1.54
Red Hat 13 advisories
- RHSA-2026:87410 Released 2026-10-21 · Red Hat rating CriticalRHOAI 2.25.12 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:74506 Released 2026-10-01 · Red Hat rating CriticalSatellite 6.16.14 Async Update
- Red Hat Satellite 6.16 for RHEL 8 foreman-3.12.0.23-1.el8sat, foreman-cli-3.12.0.23-1.el8sat, foreman-debug-3.12.0.23-1.el8sat +32
- Red Hat Satellite 6.16 for RHEL 9 foreman-3.12.0.23-1.el9sat, foreman-cli-3.12.0.23-1.el9sat, foreman-debug-3.12.0.23-1.el9sat +32
Show 10 more Red Hat advisories
- RHSA-2026:74505 Released 2026-10-01 · Red Hat rating CriticalSatellite 6.17.12 Async Update
- Red Hat Satellite 6.17 for RHEL 9 foreman-3.14.0.22-1.el9sat, foreman-cli-3.14.0.22-1.el9sat, foreman-debug-3.14.0.22-1.el9sat +31
- RHSA-2026:71210 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.5 Container Release Update
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8 +4
- RHSA-2026:71179 Released 2026-09-23 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.6 Container Release Update
- Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
- RHSA-2026:68780 Released 2026-09-17 · Red Hat rating CriticalTechnical preview of the satellite/iop-vmaas-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vmaas-rhel9
- RHSA-2026:68776 Released 2026-09-17 · Red Hat rating Criticalsatellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
- RHSA-2026:68771 Released 2026-09-17 · Red Hat rating Criticalsatellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
- RHSA-2026:68764 Released 2026-09-17 · Red Hat rating CriticalTechnical preview of the satellite/iop-vmaas-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vmaas-rhel9
- RHSA-2026:67279 Released 2026-09-14 · Red Hat rating CriticalRed Hat Ansible Automation Platform 2.7 Container Release Update
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9, registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9 +7
- RHSA-2026:65126 Released 2026-09-08 · Red Hat rating ImportantRHOAI 2.25.11 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
- RHSA-2026:63385 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.19.4 Async Update
- Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
gitpython-developers GitPython 3.1.54
3 records Highest priority Priority HIGH 2 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-51708 GitPython before 3.1.54 Arbitrary File Overwrite via diffPriority HIGH 67
- TI-2026-51709 GitPython before 3.1.54 Remote Code Execution via kwarg value smugglingPriority MEDIUM 41
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.5 | Fixed | RHSA-2026:71210 |
| Red Hat Ansible Automation Platform 2.6 | Fixed | RHSA-2026:71179 |
| Red Hat Ansible Automation Platform 2.7 | Fixed | RHSA-2026:67279 |
| Red Hat OpenShift AI 2.25 | Fixed | RHSA-2026:65126, RHSA-2026:87410 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:74506 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:74506 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:74505 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:68764, RHSA-2026:68771 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:68776, RHSA-2026:68780 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:63385 |
Not affected: 12 products
- Migration Toolkit for Applications 8
- Pen Drive Powered by Red Hat Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.5
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Red Hat Hardened Images
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift AI 3.4
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat Satellite 6.19 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-73623
- 2026-10-03 Alias added: GHSA-2726-phmx-rc26
- 2026-10-06 Fix available: RHSA-2026:74506 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:74505 · Red Hat
- 2026-10-06 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 · Red Hat
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
- 2026-10-23 Affected versions changed · Red Hat
References
More gitpython-developers Gitpython vulnerabilities
- TI-2026-54689 GitPython before 3.1.59 Path Traversal via separate-git-dir CVSS 4.0HIGH 8.7
- TI-2026-51706 GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() CVSS 4.0HIGH 8.7
- TI-2026-47618 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from CVSS 4.0HIGH 8.7
- TI-2026-30595 GitPython: Unsafe option check validates multi_options before shlex.split transforms it CVSS 3.1CRITICAL 9.8
- TI-2026-32220 GitPython: Path traversal in GitPython reference APIs allows arbitrary file write and delete outside the repository CVSS 4.0HIGH 7.8
- TI-2026-47621 GitPython before 3.1.51 Command Injection via option prefix abbreviation CVSS 4.0HIGH 8.7
Sources
- CVE-2026-73623 · CVE Program
- CVE-2026-73623 · NVD
- FIRST EPSS
- GHSA-2726-phmx-rc26 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-73623 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences