Untrusted search path on Windows systems leading to arbitrary code execution

CVE-2023-40590

What is CVE-2023-40590?

A vulnerability in the GitPython library enables arbitrary command execution on Windows OS due to the way Python resolves executables. When Python runs GitPython, it searches for the current working directory first, before checking the PATH environment variable. If a malicious repository contains a 'git' executable, executing GitPython from that directory could lead to unintentional execution of arbitrary commands, posing a threat to user systems. To mitigate this risk, users are advised to define an absolute path for the 'git' executable via the GIT_PYTHON_GIT_EXECUTABLE environment variable, avoid running GitPython from untrusted repositories, and monitor GitPython documentation for further guidance. Temporary workarounds offer limited relief until a permanent solution is found.

References