--- id: CVE-2026-67325 title: >- GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature summary: >- GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uplo… severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-78 - CWE-184 published: '2026-08-01' updated: '2026-08-01' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67325' references: - url: >- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx label: disclosure@vulncheck.com - url: >- https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation label: disclosure@vulncheck.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67325.json - url: 'https://access.redhat.com/security/cve/CVE-2026-67325' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2509975' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67325' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67325' - url: 'https://access.redhat.com/errata/RHSA-2026:59135' - url: 'https://access.redhat.com/errata/RHSA-2026:59136' - url: 'https://access.redhat.com/errata/RHSA-2026:59159' - url: 'https://access.redhat.com/errata/RHSA-2026:59155' - url: 'https://access.redhat.com/errata/RHSA-2026:44416' - url: 'https://access.redhat.com/errata/RHSA-2026:45940' - url: 'https://access.redhat.com/errata/RHSA-2026:45785' - url: 'https://access.redhat.com/errata/RHSA-2026:63372' - url: 'https://access.redhat.com/errata/RHSA-2026:63334' - url: 'https://access.redhat.com/errata/RHSA-2026:63354' - url: 'https://access.redhat.com/errata/RHSA-2026:63337' - url: 'https://github.com/gitpython-developers/GitPython/pull/2161' - url: >- https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285 - url: 'https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51' - url: 'https://github.com/advisories/GHSA-2f96-g7mh-g2hx' - url: 'https://github.com/gitpython-developers/GitPython' - url: 'https://access.redhat.com/errata/RHSA-2026:65126' - url: 'https://pypi.org/project/gitpython' - url: 'https://access.redhat.com/errata/RHSA-2026:67279' - url: 'https://access.redhat.com/errata/RHSA-2026:71114' - url: 'https://access.redhat.com/errata/RHSA-2026:71113' - url: 'https://access.redhat.com/errata/RHSA-2026:71210' - url: 'https://access.redhat.com/errata/RHSA-2026:71179' tags: - nvd - csaf - vex - red-hat - ghsa - pip - osv ingestedAt: '2026-08-02T07:18:02.241Z' epss: 0.02209 epssPercentile: 0.81857 vendor: Red Hat product: Red Hat OpenShift AI (RHOAI) affected: - exploit_intelligence - migration_toolkit_for_applications 8 - ai_inference_server - ansible_automation_platform 2 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - ansible_automation_platform_2_5_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - hardened_images - satellite 6.18 - satellite 6.19 patched: - ansible_automation_platform_2_5_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - hardened_images - satellite 6.18 - satellite 6.19 aliases: - GHSA-2f96-g7mh-g2hx - PYSEC-2026-3836 ecosystem: pip --- ## Overview GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:59135** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59135) - **RHSA-2026:59136** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59136) - **RHSA-2026:59159** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59159) - **RHSA-2026:59155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59155) - **RHSA-2026:44416** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44416) - **RHSA-2026:45940** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:45940) - **RHSA-2026:45785** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:45785) - **RHSA-2026:63372** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63372) - **RHSA-2026:63334** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63334) - **RHSA-2026:63354** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63354) - **RHSA-2026:63337** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63337) - **Red Hat VEX** · Important · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat Enterprise Linux AI (RHEL AI) 3, … · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67325.json) - **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126) - **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279) - **RHSA-2026:71114** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71114) - **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113) - **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210) - **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179) ## Package advisory (CVE-2026-67325) Affected packages: - `GitPython <= 3.1.50` Patched in: - `GitPython 3.1.51` Source: https://github.com/advisories/GHSA-2f96-g7mh-g2hx