Skip to content
Fencer Vulns
high 7.8

CVE-2023-40590 json

Untrusted search path on Windows systems leading to arbitrary code execution

published 2023-08-28 3 y ago modified 2026-09-10 1 mo ago also GHSA-wfm5-v35h-vwf4 , PYSEC-2023-161 , EUVD-2023-0086

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits
0
none known

Summary

GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.

Patch / fix

  • pypi gitpython 3.1.33
  • python-GitPython openSUSE Tumbleweed 3.1.56-1.1

opensuse advisories openSUSE-SU-2026:11419-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-40590 updated cvss 7.8

gitpython: improper executable lookup on windows

  • Red Hat Ansible Automation Platform 2 python-gitdb, python-smmap, python-gitpython, python3x-gitpython, automation-controller Red Hat Certification for Red Hat Enterprise Linux 7 redhat-certification Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification Red Hat OpenStack Platform 16.1 python3-gitdb, python3-smmap, python3-GitPython Red Hat OpenStack Platform 16.2 python3-gitdb, python3-smmap, python3-GitPython
    +3 more products
    Red Hat OpenStack Platform 17.0 python3-gitdb, python3-smmap, python3-GitPython Red Hat OpenStack Platform 17.1 GitPython, python3-gitdb, python3-smmap, python3-GitPython Red Hat Satellite 6 python-gitdb, python-smmap, python-gitpython
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi gitpython
<3.1.33
3.1.33

Affected products

  • gitpython-developers GitPython

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.