CVE-2023-40590

CVE-2023-40590 affects the GitPython library, primarily on Windows systems, due to how Python resolves executables. An attacker can trick a user into downloading a malicious repository containing a fake 'git.exe' or 'git' executable, which GitPython will then execute instead of the legitimate Git program, leading to arbitrary command execution. This vulnerability has a CVSS score of 7.8 (HIGH) with a local attack vector and low attack complexity, allowing for high impact on confidentiality, integrity, and availability if a user is socially engineered. There is currently no evidence of active exploitation, no public exploit code, and minimal community discussion surrounding this vulnerability.