CVE-2026-67325: GitPython before 3.1.51 Command Injection via option prefix abbreviation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-08-01 · updated 2026-10-23
Weakness: CWE-78

Description

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

Affected products

gitpython-developers GitPython: before 3.1.51 — fixed in 3.1.51

How to fix

Upgrade to a fixed version: gitpython-developers GitPython 3.1.51. Check the vendor advisory for mitigations.

References

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx
https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx

Get alerted when CVE-2026-67325 or the next vulnerability affects your stack