{"cve":"CVE-2023-40590","nvd":{"published":"2023-08-28T18:15:08.937","modified":"2026-06-17T06:18:36.627","status":"Modified","description":"GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\\\Program Files\\\\Git\\\\cmd\\\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8},"cwes":["CWE-426"],"references":["https://docs.python.org/3/library/subprocess.html#popen-constructor","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4","https://docs.python.org/3/library/subprocess.html#popen-constructor","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4"],"products":["gitpython_project:gitpython"],"source":"nvd","synced_at":"2026-10-19T21:39:14.809778102+00:00"},"epss":{"cve":"CVE-2023-40590","score":0.00509,"percentile":0.4344,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-wfm5-v35h-vwf4","url":"https://osv.dev/vulnerability/GHSA-wfm5-v35h-vwf4","summary":"GitPython untrusted search path on Windows systems leading to arbitrary code execution","modified":"2026-09-10T03:49:57.778784153Z","packages":[{"ecosystem":"PyPI","name":"gitpython","purl":"pkg:pypi/gitpython","ranges":["<3.1.33"],"fixed":["3.1.33"]}]},{"id":"PYSEC-2023-161","url":"https://osv.dev/vulnerability/PYSEC-2023-161","summary":"","modified":"2023-11-08T04:13:22.478104Z","packages":[{"ecosystem":"PyPI","name":"gitpython","purl":"pkg:pypi/gitpython","ranges":["<3.1.33"],"fixed":["3.1.33"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}