Command Injection Vulnerability in GitPython by GitPython Developers

CVE-2026-67323

What is CVE-2026-67323?

A command injection vulnerability exists in GitPython versions prior to 3.1.51. This flaw arises from the failure to validate Git options passed as keyword arguments in critical methods such as Repo.archive() and git.ls_remote(), allowing attackers to execute arbitrary commands. Additionally, methods like Repo.iter_commits() and Repo.blame() do not adequately check for leading-dash revision arguments, potentially enabling an attacker to open and truncate arbitrary files using a revision like --output=. Exploitation of this vulnerability necessitates that an application inadvertently passes attacker-controlled arguments to these methods, significantly compromising the application's security.

References