CVE-2023-40267

CriticalCVSS 9.8

Published: 11/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.98%

57th percentile - higher than 57% of all known CVEs

Summary

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. This issue exists because of an incomplete fix for CVE-2022-24439.

Risk Assessment

Organizations may be exposed to the exploitation of insecure options, potentially leading to unauthorized access to repositories.

Recommendation

It is recommended to upgrade GitPython to version 3.1.32 or later to mitigate the risk associated with this vulnerability.

Original NVD description (English source)

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. NOTE: this issue exists because of an incomplete fix for CVE-2022-24439.