PyPI/gitpython CVE-2023-40590: high 7.8, EPSS 0.51%

GitPython untrusted search path on Windows systems leading to arbitrary code execution

Action: Upgrade gitpython to 3.1.33 or later.

pip install gitpython==3.1.33

Affected

Fixed versions

Sources

• osv: GHSA-wfm5-v35h-vwf4
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4
• https://nvd.nist.gov/vuln/detail/CVE-2023-40590
• https://github.com/gitpython-developers/GitPython/issues/1635
• https://github.com/gitpython-developers/GitPython/pull/1636
• https://github.com/gitpython-developers/GitPython/commit/8b75434e2c8a082cdeb4971cc6f0ee2bafec45bc
• https://docs.python.org/3/library/subprocess.html#popen-constructor
• https://github.com/gitpython-developers/GitPython
• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.33
• https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2023-161.yaml

CVE-2023-40590 · published 2023-08-29T23:33:53Z · modified 2026-09-10T03:49:57.778784153Z · JSON