Skip to main content

GitPython CVE-2026-67323

| EUVDEUVD-2026-51805 HIGH
Command Injection (CWE-77)
2026-08-01 VulnCheck GHSA-4vpg-pfj8-m33q GHSA-956x-8gvw-wg5v
Command Injection Gitpython Gitpython Developers
8.6
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.6 HIGH
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.0 CRITICAL

Network vector because consuming applications are typically network-facing; AC:H because exploitation requires the application to pass attacker-controlled arguments to specific GitPython methods, a non-default pattern not present in all deployments.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.4 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 01, 2026 - 13:20 vuln.today
Analysis Generated
Aug 01, 2026 - 13:20 vuln.today
Patch available
Aug 01, 2026 - 13:01 EUVD
CVE Published
Aug 01, 2026 - 12:22 cve.org
HIGH 8.6

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2 pypi packages depend on gitpython (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.1.51.

DescriptionCVE.org

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.

AnalysisAI

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-controlled arguments to four public API methods. Repo.archive() and git.ls_remote() forward caller-supplied keyword arguments into the git argument vector without consulting GitPython's own unsafe-options denylist, enabling arbitrary command execution via options such as --exec or --upload-pack. Repo.iter_commits() and Repo.blame() accept unsanitized revision strings without a leading-dash check, so a value like --output=/path/to/file is interpreted by git as an option, truncating an arbitrary file. No public exploit code or CISA KEV listing was identified at time of analysis; a vendor-released patch is available in 3.1.51.

Technical ContextAI

GitPython is a Python library that wraps the system git binary by constructing argument vectors programmatically and spawning subprocesses. It maintains an explicit denylist of dangerous options (--upload-pack, --receive-pack, --exec, -c, --config) enforced via Git.check_unsafe_options() at git/cmd.py:963, but this guard is wired only to the network-facing commands (clone_from, Remote.fetch, Remote.pull, Remote.push). CWE-77 (Improper Neutralization of Special Elements used in a Command) applies because Repo.archive() blindly forwards **kwargs to git archive, allowing --exec=<cmd> to override the helper binary invoked by git archive --remote, and git.ls_remote() similarly passes upload_pack=<cmd> as --upload-pack=<cmd> with no guard. The file-overwrite primitive in Repo.iter_commits() and Repo.blame() arises because the caller's revision string is inserted into the argv before the -- end-of-options separator; git therefore interprets a leading-dash value (e.g., --output=/etc/crontab) as a legitimate option, truncating the target file before validating the revision. The affected CPE is cpe:2.3:a:gitpython-developers:gitpython:*:*:*:*:*:*:*:* for all versions prior to 3.1.51.

RemediationAI

Upgrade GitPython to version 3.1.51 or later via pip install --upgrade 'GitPython>=3.1.51'; this release extends check_unsafe_options() enforcement to Repo.archive() and git.ls_remote() and adds leading-dash validation to revision parameters in Repo.iter_commits() and Repo.blame(). The upstream fix is confirmed in PR https://github.com/gitpython-developers/GitPython/pull/2163 and commit https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738. If an immediate upgrade is not feasible, applications should sanitize all arguments before calling the affected methods: reject any kwarg key or value matching --exec, --upload-pack, --receive-pack, or any leading-dash pattern, and validate that revision strings do not begin with - before passing them to iter_commits() or blame(). As a compensating control, restricting outbound network access of the git subprocess (via network namespaces or egress firewall rules) limits the usefulness of command injection for establishing reverse shells but does not prevent local command execution or file clobber. Refer to the vendor advisory at https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v for full mitigation guidance.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-78676 CRITICAL POC
9.3 Aug 25

Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67325 HIGH POC
8.7 Aug 01

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
CVE-2026-42215 HIGH POC
8.8 May 07

Command injection in GitPython 3.1.30-3.1.46 allows remote authenticated attackers to execute arbitrary commands via und
CVE-2026-73625 HIGH
8.7 Aug 13

Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
CVE-2026-76220 HIGH POC
8.7 Aug 19

Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using

CVE-2026-78677 HIGH POC
8.7 Aug 25

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
CVE-2026-76221 HIGH
8.7 Aug 19

Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution vi

Same weakness CWE-77 – Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8
CVE-2017-6327 HIGH POC
8.8
CVE-2023-34960 CRITICAL POC
9.8
CVE-2023-37679 CRITICAL POC
9.8

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-67323 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy