CVE-2026-73625 is an OS command injection vulnerability in GitPython prior to version 3.1.54. The vulnerability arises because the check_unsafe_options guard can be bypassed by embedding git options within single-character keyword argument values. This allows attackers to supply specially crafted option dictionaries to methods such as clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive, resulting in arbitrary OS command execution through the --upload-pack parameter.

Successful exploitation of this vulnerability enables remote code execution with low attack complexity and no user interaction required. The attacker can execute arbitrary OS commands on the system running the vulnerable GitPython version, potentially leading to full system compromise or unauthorized actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or patch is released, avoid using vulnerable GitPython versions in untrusted environments or restrict usage to trusted inputs only.