CVE-2026-73623 describes an OS command injection vulnerability in GitPython prior to version 3.1.54. The vulnerability arises because the denylist in unsafe_git_clone_options does not include the --template option. Attackers can exploit this by supplying a --template argument that points to a directory containing malicious post-checkout hooks. When GitPython clones the repository, these hooks execute, resulting in arbitrary command execution.

Successful exploitation allows an attacker with the ability to influence clone operations to execute arbitrary commands on the host system with the privileges of the GitPython process. This can lead to system compromise or unauthorized actions.

No official patch or remediation level has been confirmed yet. Users should monitor the vendor advisory for updates and apply the official fix once available. Until then, avoid using untrusted input for clone options, especially the --template parameter.