CVE-2023-40590: Vulnerability in GitPython
Summary
CVE-2023-40590: GitPython is a python library used to interact with Git repositories. Affects gitpython versions < 3.1.33. Fixed in 3.1.33. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GitPython is a Python library used for interacting with Git repositories. It provides functionality to perform various Git operations programmatically. This vulnerability affects GitPython on Windows systems. When resolving a program, Python/Windows first looks for the current working directory and then the PATH environment variable. By default, GitPython uses the git command to interact with Git. However, if a user runs GitPython from a repository that contains a malicious git.exe or git executable, it will be executed instead of the one in the user's PATH. This can allow an attacker to run arbitrary commands on the system. It's important to note that this vulnerability is specific to Windows systems, and other operating systems are not affected.
Vulnerability Detail
The vulnerability arises due to the way Python interacts with Windows systems. An attacker can trick a user into downloading a repository with a malicious git executable. If the user runs or imports GitPython from that directory, the attacker can execute arbitrary commands on the system. This can lead to unauthorized access, data manipulation, or other malicious activities. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Latest published version: 3.2.1 as of 23 Oct 2026
pip install --upgrade "gitpython==3.2.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.33
This is the first release that contains the fix.
pip install --upgrade "gitpython==3.1.33"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can follow the steps below:
- Set the
GIT_PYTHON_GIT_EXECUTABLEenvironment variable to an absolute path of a trustedgitexecutable. - Ensure that the
gitexecutable used by GitPython is not located in the current working directory or any untrusted repository.
Example:
export GIT_PYTHON_GIT_EXECUTABLE=/path/to/git
By setting the environment variable to a trusted git executable, the vulnerability can be mitigated.
Conclusion
The vulnerability in GitPython on Windows systems allows an attacker to execute arbitrary commands on the system. While there is no fix currently available, there are mitigations that can be implemented to reduce the risk. It is important to follow the suggested workarounds and take necessary precautions when using GitPython, such as setting the GIT_PYTHON_GIT_EXECUTABLE environment variable to a trusted git executable. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for gitpython →
FAQ
GitPython is a Python library used for interacting with Git repositories. It provides a convenient way to perform Git operations programmatically.
This vulnerability affects GitPython on Windows systems. Other operating systems are not affected.
The vulnerability allows an attacker to execute arbitrary commands on the system when GitPython is run from a repository with a malicious git executable. This can lead to unauthorized access, data manipulation, or other malicious activities.
Currently, there is no fix available for Windows users. However, there are mitigations that can be implemented to reduce the risk.
To mitigate this vulnerability, users can follow the provided workarounds and implement the suggested mitigations, such as setting the GIT_PYTHON_GIT_EXECUTABLE environment variable to a trusted git executable.
References
Related vulnerabilities
Recent vulnerabilities recorded for gitpython.
