CVE-2026-67325 HIGH

CVE-2026-67325: GitPython before 3.1.51 Command Injection via option prefix abbreviation

Vendor Gitpython-Developers

Product GitPython

Weakness CWE-78

Published August 1, 2026

Last update August 5, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

Key dates

02Disclosure timeline

August 1, 2026 CVE published

August 5, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-67325 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/78.html AskarLabs — CWE-78 write-up OS Command Injection

Related vulnerabilities

04Related CVE

CVE-2023-7002 Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url CVE-2024-49281 WordPress Click to Chat – WP Support All-in-One Floating Widget plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-27938 WPGraphQL Repo Vulnerable to Command Injection via Unsanitized GitHub Actions Expression in Release Workflow CVE-2021-24684 PDF Light Viewer < 1.4.12 - Authenticated Command Injection CVE-2025-9762 Post By Email <= 1.0.4b - Unauthenticated Arbitrary File Upload via Email Attachments