CVE-2026-67325
Received Received - Intake

Git Command Injection in GitPython via Abbreviated Options

Publication date: 2026-08-01

Last updated on: 2026-08-01

Assigner: VulnCheck

Description
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-01
Last Modified
2026-08-01
Generated
2026-08-01
AI Q&A
2026-08-01
EPSS Evaluated
N/A
NVD
CVE-2026-67325
EUVD
EUVD-2026-51858

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitpython gitpython to 3.1.51 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitPython before 3.1.51 has an incomplete command injection blocklist that fails to block git's long-option prefix abbreviation feature. Attackers can bypass protections by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

Detection Guidance

Detecting this vulnerability requires checking for outdated GitPython versions. Run pip show gitpython to check the installed version. If it is below 3.1.51, the system is vulnerable. Additionally, inspect code using GitPython for unsafe command execution patterns.

Impact Analysis

If you use GitPython versions before 3.1.51, attackers could exploit this to run arbitrary commands on your system by crafting malicious git commands through GitPython's interface. This could lead to unauthorized code execution, data theft, or system compromise depending on the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade GitPython to version 3.1.51 or later immediately. If upgrading is not possible, review and modify code to avoid using GitPython for executing git commands or implement strict input validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67325. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart