Skip to main content

GitPython CVE-2026-67323

| EUVDEUVD-2026-51805 HIGH
Command Injection (CWE-77)
2026-08-01 VulnCheck GHSA-4vpg-pfj8-m33q
Command Injection Gitpython
8.6
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.6 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.0 CRITICAL

Network vector because consuming applications are typically network-facing; AC:H because exploitation requires the application to pass attacker-controlled arguments to specific GitPython methods, a non-default pattern not present in all deployments.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.4 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 01, 2026 - 13:20 vuln.today
Analysis Generated
Aug 01, 2026 - 13:20 vuln.today
Patch available
Aug 01, 2026 - 13:01 EUVD
CVE Published
Aug 01, 2026 - 12:22 cve.org
HIGH 8.6

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2 pypi packages depend on gitpython (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.1.51.

DescriptionCVE.org

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.

AnalysisAI

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-controlled arguments to four public API methods. Repo.archive() and git.ls_remote() forward caller-supplied keyword arguments into the git argument vector without consulting GitPython's own unsafe-options denylist, enabling arbitrary command execution via options such as --exec or --upload-pack. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify network-facing endpoint calling vulnerable GitPython method
Delivery
Supply malicious kwarg or revision string as user input
Exploit
GitPython builds git argv without unsafe-option check
Execution
Git binary parses attacker-supplied option
Impact
Execute arbitrary OS command or truncate arbitrary file on server
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation of the command injection vectors (`Repo.archive()`, `git.ls_remote()`) requires that the consuming application pass attacker-controlled keyword arguments to these GitPython methods - for example, a web or API endpoint that maps user-submitted parameters directly to `git archive` options or git remote URLs. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The provided CVSS 4.0 score of 8.6 with vector AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H reflects a local attack vector, which describes the library's process-execution context rather than the network reachability of applications consuming GitPython. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A self-hosted code review platform accepts a user-supplied archive format and optional remote URL, passing them as kwargs to `Repo.archive(treeish=user_branch, **user_options)`; an attacker submits `{"remote": ".", "exec": "/bin/bash -c 'id > /tmp/pwned'"}`, causing GitPython to invoke `git archive --remote=. --exec=/bin/bash -c 'id > /tmp/pwned'`, which triggers `git-upload-archive` with the attacker-controlled executable and achieves arbitrary command execution in the server process. …
Remediation Upgrade GitPython to version 3.1.51 or later via `pip install --upgrade 'GitPython>=3.1.51'`; this release extends `check_unsafe_options()` enforcement to `Repo.archive()` and `git.ls_remote()` and adds leading-dash validation to revision parameters in `Repo.iter_commits()` and `Repo.blame()`. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems, applications, and services within your organization that depend on GitPython, documenting the current version and deployment environment; simultaneously begin testing GitPython version 3.1.51 in non-production environments to verify compatibility. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67325 HIGH
8.7 Aug 01

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
CVE-2026-67322 HIGH
8.7 Aug 01

Environment variable exfiltration in GitPython before 3.1.52 allows any attacker who controls a URL passed to `Repo.clon
CVE-2026-67326 HIGH
7.3 Aug 01

Remote code execution via newline injection in GitPython before 3.1.50 allows an attacker who controls the section argum
CVE-2026-69097 HIGH
7.3 Aug 03

Git-config section-name injection in GitPython <= 3.1.52 enables remote code execution by writing attacker-controlled `c
CVE-2024-22190 HIGH POC
7.8 Jan 11

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-67323 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy