What is GHSA-2726-phmx-rc26?

GHSA-2726-phmx-rc26 is a security advisory published by GitHub Security Advisories with High severity. GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits -...

Which CVE IDs does GHSA-2726-phmx-rc26 cover?

GHSA-2726-phmx-rc26 covers the following CVE IDs: CVE-2026-73623. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2726-phmx-rc26?

GHSA-2726-phmx-rc26 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-2726-phmx-rc26HighCVSS 7.5

GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits -...

Vendor

GitHub Security Advisories

Published

August 13, 2026

Last Modified

August 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-73623 →

📋 Description

GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository.

🔗 References (4)

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf
https://nvd.nist.gov/vuln/detail/CVE-2026-73623
https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template
https://github.com/advisories/GHSA-2726-phmx-rc26