PT-2023-4751 · Gitpython+1 · Gitpython+1

Stsewd · Published 2023-08-28 · Updated 2025-10-17 · CVE-2023-40590

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitPython (affected versions not specified)

Description The issue is related to how Python interacts with Windows systems, specifically when resolving a program. GitPython defaults to use the git command, and if a user runs it from a repository with a git.exe or git executable, that program will be run instead of the one in the user's PATH. This allows an attacker to trick a user into downloading a repository with a malicious git executable, enabling the attacker to run arbitrary commands. The problem is more significant on Windows systems, as Linux and other OS are not affected.

Recommendations

1. Default to an absolute path for the git program on Windows, like C:Program FilesGitcmdgit.EXE (default git path installation).
2. Require users to set the GIT PYTHON GIT EXECUTABLE environment variable on Windows systems.
3. Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repository, or set the GIT PYTHON GIT EXECUTABLE env var to an absolute path.
4. Resolve the executable manually by only looking into the PATH environment variable. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

ALT-PU-2023-6832

ALT-PU-2023-8078

BDU:2023-05185

CVE-2023-40590

GHSA-WFM5-V35H-VWF4

OPENSUSE-SU-2024:13207-1

PYSEC-2023-161

Affected Products

Alt Linux

Gitpython

References · 29

• 🔥 https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40590.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2023-161 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-40590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40590 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-40590 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-40590 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05185 · Security Note
• https://osv.dev/vulnerability/GHSA-wfm5-v35h-vwf4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40590 · Vendor Advisory
• https://github.com/gitpython-developers/GitPython · Note
• https://github.com/gitpython-developers/GitPython/releases/tag/3.1.33 · Note
• https://github.com/gitpython-developers/GitPython/commit/8b75434e2c8a082cdeb4971cc6f0ee2bafec45bc · Note
• https://github.com/gitpython-developers/GitPython/issues/1635 · Note
• https://github.com/gitpython-developers/GitPython/pull/1636 · Note