CVE-2026-73625High· 8.8▾ TwilightA flaw was found in GitPython. Attackers can bypass the `check_unsafe_options` guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to vari…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
0.5% → 0.7%
Last analysed / modified upstream
A flaw was found in GitPython. Attackers can bypass the check_unsafe_options guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as clone_from or fetch, leading to arbitrary code execution.
gitpython: GitPython: Remote Code Execution via kwarg value smuggling — rated Important by Red Hat. Released 2026-08-13, updated 2026-09-21.
Affected:
Fixed:
No fix planned:
Not affected:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For detailed instructions how to apply this update, refer to:
https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index https://access.redhat.com/errata/RHSA-2026:63385 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.7#Upgrade https://access.redhat.com/errata/RHSA-2026:67279 For Red Hat OpenShift AI 2.25.11 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:65126
Workarounds / mitigations:
Affected packages:
gitpython < 3.1.54Patched in:
gitpython 3.1.54Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73623High· 7.5gitpython: GitPython: Remote Code Execution via malicious Git template (CVE-2026-73623)
CVE-2026-73624High· 8.1GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs
CVE-2026-73622High· 7.5gitpython: GitPython: Information disclosure via environment variable expansion in URL handling (CVE-2026-73622)
CVE-2026-69243High· 7.0AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-69244High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
CVE-2026-73415High· 8.0jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture