CVE-2026-67325: GitPython before 3.1.51 Command Injection via option prefix abbreviation
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uploadp instead of uploadpack, which git resolves to dangerous options and executes arbitrary commands.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.51 - Compensating control
Use a GitPython version at or after 3.1.51 to prevent command injection via option prefix abbreviation (e.g., abbreviated option names like upload_p resolving to upload_pack).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67325?
The severity of CVE-2026-67325 is rated as high with a score of 8.7.
How do I fix CVE-2026-67325?
To fix CVE-2026-67325, upgrade GitPython to version 3.1.51 or later.
What type of vulnerability is CVE-2026-67325?
CVE-2026-67325 is classified as an OS Command Injection vulnerability.
What software is affected by CVE-2026-67325?
CVE-2026-67325 affects GitPython versions prior to 3.1.51.
What can attackers exploit in CVE-2026-67325?
Attackers can exploit CVE-2026-67325 by using abbreviated option names to bypass the command injection guard.