--- id: CVE-2026-67323 title: >- GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command exe… summary: >- GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command exe… severity: high cvss: 8.4 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-77 - CWE-88 published: '2026-08-01' updated: '2026-08-01' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67323' references: - url: >- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v label: disclosure@vulncheck.com - url: >- https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options label: disclosure@vulncheck.com - url: 'https://github.com/gitpython-developers/GitPython/pull/2163' - url: >- https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738 - url: 'https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67323' - url: 'https://github.com/advisories/GHSA-956x-8gvw-wg5v' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67323.json - url: 'https://access.redhat.com/security/cve/CVE-2026-67323' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2509976' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67323' - url: 'https://access.redhat.com/errata/RHSA-2026:59135' - url: 'https://access.redhat.com/errata/RHSA-2026:59136' - url: 'https://access.redhat.com/errata/RHSA-2026:44416' - url: 'https://access.redhat.com/errata/RHSA-2026:45940' - url: 'https://access.redhat.com/errata/RHSA-2026:45785' - url: 'https://access.redhat.com/errata/RHSA-2026:63372' - url: 'https://access.redhat.com/errata/RHSA-2026:63334' - url: 'https://access.redhat.com/errata/RHSA-2026:63354' - url: 'https://access.redhat.com/errata/RHSA-2026:63337' - url: 'https://github.com/gitpython-developers/GitPython' - url: 'https://access.redhat.com/errata/RHSA-2026:65126' - url: 'https://pypi.org/project/gitpython' - url: 'https://access.redhat.com/errata/RHSA-2026:67279' - url: 'https://access.redhat.com/errata/RHSA-2026:71114' - url: 'https://access.redhat.com/errata/RHSA-2026:71113' - url: 'https://access.redhat.com/errata/RHSA-2026:71210' - url: 'https://access.redhat.com/errata/RHSA-2026:71179' tags: - nvd - ghsa - pip - csaf - vex - red-hat - osv ingestedAt: '2026-08-02T07:18:02.172Z' epss: 0.01251 epssPercentile: 0.68115 aliases: - GHSA-956x-8gvw-wg5v - PYSEC-2026-3839 ecosystem: pip vendor: GitPython product: GitPython affected: - GitPython <= 3.1.50 patched: - GitPython 3.1.51 --- ## Overview GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output= can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-67323) Affected packages: - `GitPython <= 3.1.50` Patched in: - `GitPython 3.1.51` Source: https://github.com/advisories/GHSA-956x-8gvw-wg5v ## Vendor advisories - **RHSA-2026:59135** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59135) - **RHSA-2026:59136** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59136) - **RHSA-2026:44416** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44416) - **RHSA-2026:45940** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:45940) - **RHSA-2026:45785** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:45785) - **RHSA-2026:63372** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63372) - **RHSA-2026:63334** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63334) - **RHSA-2026:63354** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63354) - **RHSA-2026:63337** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63337) - **Red Hat VEX** · Important · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Pen Drive Powered by Red Hat Lightspeed, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, … · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Exploit Intelligence, Migration Toolkit for Applications 8, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67323.json) - **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126) - **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279) - **RHSA-2026:71114** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71114) - **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113) - **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210) - **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179)