CVE-2026-67323 gitpython-developers CVE debrief

Who should care

Developers and administrators using GitPython in their applications should be aware of this vulnerability and take steps to mitigate it. This includes prioritizing patching to prevent potential command injection attacks and restricting user input to Repo.archive(), git.ls_remote(), Repo.iter_commits(), and Repo.blame(). Additionally, users should monitor GitPython usage for suspicious activity and review compensating controls for exposed systems while remediation is scheduled and verified. Security teams and vulnerability management teams should also be aware of this vulnerability and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Asset owners and operators should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. This vulnerability can have a significant impact on the security of affected systems, and users should take immediate action to mitigate the risks. The vulnerability affects a wide range of users, including those using GitPython for software development, testing, and deployment. Users should also review relevant monitoring, detection, and logs for exposed assets that need extra review. Finally, users should track exceptions, retest remediated assets, and close the item only after evidence is documented. This will help ensure that the vulnerability is properly mitigated and that affected systems are secure. The CVE record provides additional information on the vulnerability, including its CVSS score and severity classification. Users should review this information carefully to understand the risks and take appropriate action. By prioritizing patching and taking other mitigation steps, users can help prevent potential command injection attacks and protect their systems from exploitation. This vulnerability highlights the importance of secure coding practices and the need for users to be aware of the risks associated with using vulnerable software. By taking immediate action, users can help protect their systems and prevent potential security breaches. The vulnerability is a serious one, and users should take it seriously to avoid any

Technical summary

GitPython before 3.1.51 is vulnerable to command injection via unguarded Git options in Repo.archive() and git.ls_remote(). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, which can cause Git to open and truncate an arbitrary file. This vulnerability can be exploited by passing attacker-controlled arguments to these methods, potentially leading to arbitrary command execution. Affected users should prioritize patching to prevent potential command injection attacks. The vulnerability has a CVSS score of 8.6 and is classified as HIGH severity.

Defensive priority

GitPython users should prioritize patching to prevent potential command injection attacks.

Recommended defensive actions

• Apply patches for GitPython 3.1.51 or later
• Restrict user input to Repo.archive(), git.ls_remote(), Repo.iter_commits(), and Repo.blame()
• Monitor GitPython usage for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE description indicates that GitPython before 3.1.51 is vulnerable to command injection via unguarded Git options in Repo.archive() and git.ls_remote(). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, which can cause Git to open and truncate an arbitrary file. However, details on affected products and versions are limited.

Official resources