Skip to main content

GitPython CVE-2026-67325

| EUVDEUVD-2026-51858 HIGH
OS Command Injection (CWE-78)
2026-08-01 VulnCheck GHSA-6r2r-ww24-7h52
Command Injection Gitpython
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Network vector with low complexity reflects indirect exploitation through the application layer; PR:L consistent with CVSS 4.0 input; no scope change as command execution is contained within the vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 01, 2026 - 13:20 vuln.today
Analysis Generated
Aug 01, 2026 - 13:20 vuln.today
Patch available
Aug 01, 2026 - 13:01 EUVD
CVE Published
Aug 01, 2026 - 12:22 cve.org
HIGH 8.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 2 pypi packages depend on gitpython (2 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.1.51.

DescriptionCVE.org

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

AnalysisAI

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the check_unsafe_options blocklist by supplying abbreviated git option names that git's CLI resolves to dangerous long-options at runtime. This is an incomplete fix of CVE-2026-42215 (patched in 3.1.47): the guard canonicalizes only underscore-to-hyphen but does not model git's unambiguous long-option prefix abbreviation feature, so a kwarg like upload_p passes the blocklist unchanged yet arrives at git as --upload-pack, enabling arbitrary command execution. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to GitPython-consuming application
Delivery
Submit request with abbreviated unsafe option kwarg (e.g., upload_p=<cmd>)
Exploit
GitPython check_unsafe_options performs exact-match lookup, finds no blocklist hit
Execution
Abbreviated option emitted to git binary as --upload-p=<cmd>
Persist
Git resolves prefix abbreviation to --upload-pack
Impact
Attacker-controlled command executes on server
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a low-privileged authenticated session on an application that consumes GitPython (PR:L per CVSS 4.0), and critically, that application must pass user-controlled values as option keyword argument names to GitPython's git network operations (clone, fetch, pull, or push). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately reflects a high-severity but access-constrained vulnerability: low privileges are required (PR:L), meaning the attacker must hold an authenticated session on the consuming application. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A low-privileged authenticated user of a hosted code collaboration platform submits a repository clone request supplying the option kwarg `upload_p` with a value pointing to a malicious shell command. GitPython's `check_unsafe_options` canonicalizes `upload_p` to `upload-p`, finds no exact match in the blocklist dict, and passes it through; git receives `--upload-p=<malicious_command>` and resolves the prefix abbreviation to `--upload-pack`, executing the attacker-specified command under the application's process context. …
Remediation The primary fix is upgrading GitPython to version 3.1.51 or later via pip (`pip install --upgrade 'GitPython>=3.1.51'`); the fix is implemented in commit 56806080c1348749b07daa4a2024ce47b3cad285 and merged via PR https://github.com/gitpython-developers/GitPython/pull/2161. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all internal and third-party systems using GitPython, prioritizing CI/CD platforms, deployment automation, and code repositories. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67323 HIGH
8.6 Aug 01

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
CVE-2026-67322 HIGH
8.7 Aug 01

Environment variable exfiltration in GitPython before 3.1.52 allows any attacker who controls a URL passed to `Repo.clon
CVE-2026-67326 HIGH
7.3 Aug 01

Remote code execution via newline injection in GitPython before 3.1.50 allows an attacker who controls the section argum
CVE-2026-69097 HIGH
7.3 Aug 03

Git-config section-name injection in GitPython <= 3.1.52 enables remote code execution by writing attacker-controlled `c
CVE-2024-22190 HIGH POC
7.8 Jan 11

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9
CVE-2025-64328 HIGH POC
8.6

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2015-2051 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-67325 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy