{"id":"GHSA-4vpg-pfj8-m33q","title":"Duplicate Advisory: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`","summary":"Duplicate Advisory: GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`","severity":"high","cvss":8.4,"cwe":["CWE-77"],"vendor":"gitpython","product":"gitpython","ecosystem":"pip","affected":["gitpython <= 3.1.50"],"published":"2026-08-01","updated":"2026-09-08","sourceUpdated":"2026-09-08T15:08:45Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-4vpg-pfj8-m33q","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options"},{"url":"https://github.com/advisories/GHSA-4vpg-pfj8-m33q"}],"tags":["ghsa","pip"],"ingestedAt":"2026-09-08T15:33:26.986Z","slug":"GHSA-4vpg-pfj8-m33q","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-956x-8gvw-wg5v. This link is maintained to preserve external references.\n\n## Original Description\nGitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.\n\n## Affected packages\n\n- `gitpython <= 3.1.50`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":46.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}