CVE-2026-67325

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx	Exploit Vendor Advisory
https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation	Third Party Advisory
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) GitPython antes de la versión 3.1.51 contiene una lista negra de inyección de comandos incompleta que no tiene en cuenta la característica de abreviación de prefijos de opciones largas de git. Los atacantes pueden eludir la protección de opciones inseguras utilizando nombres de opciones abreviados como upload_p en lugar de upload_pack, lo que git resuelve como opciones peligrosas y ejecuta comandos arbitrarios.

Information

Published : 2026-08-01 13:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-67325

Mitre link : CVE-2026-67325

CVE.ORG link : CVE-2026-67325

JSON object : View

Products Affected

gitpython_project

gitpython

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-67325", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67325", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T03:56:16.576389Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "gitpython-developers", "product": "GitPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.1.51", "versionType": "semver"}, {"status": "unaffected", "version": "3.1.51", "versionType": "semver"}], "packageURL": "pkg:pypi/GitPython", "defaultStatus": "unaffected"}]}], "published": "2026-08-01T13:17:02.923", "references": [{"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx", "tags": ["Exploit", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands."}, {"lang": "es", "value": "GitPython antes de la versi\u00f3n 3.1.51 contiene una lista negra de inyecci\u00f3n de comandos incompleta que no tiene en cuenta la caracter\u00edstica de abreviaci\u00f3n de prefijos de opciones largas de git. Los atacantes pueden eludir la protecci\u00f3n de opciones inseguras utilizando nombres de opciones abreviados como upload_p en lugar de upload_pack, lo que git resuelve como opciones peligrosas y ejecuta comandos arbitrarios."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "BD651D46-EA45-4549-AF25-F3D0454375EA", "versionEndExcluding": "3.1.51"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}