CVE-2026-67323 Details
Description
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.
A command injection vulnerability has been identified in GitPython versions prior to 3.1.51. The issue arises because the library fails to properly validate certain Git options passed as keyword arguments in the `Repo.archive()` and `git.ls_remote()` methods. This oversight allows for the injection of malicious commands via options like `--exec` and `--upload-pack`, potentially leading to arbitrary command execution. Additionally, the `Repo.iter_commits()` and `Repo.blame()` methods lack checks for leading-dash revision arguments, enabling a revision formatted like `--output=<path>` to cause Git to open and truncate a specified file. Exploitation of this vulnerability requires an application to pass user-controlled arguments to these methods.
Users should upgrade to GitPython version 3.1.51 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v | CISA-ADP | ExploitVendor Advisory |
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v | [email protected] | ExploitVendor Advisory |
| https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options | [email protected] | Third Party AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gitpython project gitpython | < 3.1.51 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | Initial Analysis | [email protected] |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |