Command Injection Vulnerability in GitPython Software by GitPython Developers
CVE-2026-67325

8.7HIGH

Key Information:

Vendor

Gitpython-developers

Status
Gitpython
Vendor
CVE Published:
1 August 2026

What is CVE-2026-67325?

An incomplete command injection blocklist in GitPython versions prior to 3.1.51 allows attackers to evade the guard against unsafe command options. By utilizing git's long-option prefix abbreviation feature, malicious users can substitute abbreviated option names (such as using 'upload_p' in place of 'upload_pack') to bypass security measures. If exploited, this flaw may lead to the execution of arbitrary commands, posing a significant risk to systems utilizing the affected GitPython versions. It's crucial for users to update to the latest version to mitigate potential threats.

Affected Version(s)

GitPython 0 < 3.1.51

GitPython 3.1.51

References

https://github.com/gitpython-developers/GitPython/securit...
vendor-advisory
https://www.vulncheck.com/advisories/gitpython-before-com...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

hackkim
abhiprd2000
.