---
id: GHSA-4vpg-pfj8-m33q
title: >-
  Duplicate Advisory: GitPython: command injection via unguarded Git options in
  `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via
  `Repo.iter_commits()` / `Repo.blame()`
summary: >-
  Duplicate Advisory: GitPython: command injection via unguarded Git options in
  `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via
  `Repo.iter_commits()` / `Repo.blame()`
severity: high
cvss: 8.4
cwe:
  - CWE-77
vendor: gitpython
product: gitpython
ecosystem: pip
affected:
  - gitpython <= 3.1.50
published: '2026-08-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T15:08:45Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-4vpg-pfj8-m33q'
references:
  - url: >-
      https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67323'
  - url: >-
      https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options
  - url: 'https://github.com/advisories/GHSA-4vpg-pfj8-m33q'
tags:
  - ghsa
  - pip
ingestedAt: '2026-09-08T15:33:26.986Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-956x-8gvw-wg5v. This link is maintained to preserve external references.

## Original Description
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.

## Affected packages

- `gitpython <= 3.1.50`

## Remediation

Refer to the advisory for the patched release.