CVE-2026-67325CWE-78command-injection

CVE-2026-67325

High · published August 1, 2026

CVSS v3.1
8.8
EPSS
2%
Percentile
82.5
In the wild
Unconfirmed
What it is

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02209 · 82.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-01T17:17Z
Affected products (1)
ProductVersionsFixed in
gitpython_project/gitpython< 3.1.513.1.51
References (3)
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx · [email protected]https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation · [email protected]https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 01 AUG 12:22Z
    GitPython before 3.1.51 Command Injection via option prefix abbreviation
    cvelistv5