CVE-2026-67325 gitpython-developers CVE debrief

Who should care

Users of GitPython, especially those using versions before 3.1.51, should be aware of this vulnerability and take steps to mitigate it. This includes developers using GitPython in their projects, system administrators managing systems with GitPython installed, and security teams responsible for vulnerability management. These stakeholders should assess their exposure, apply patches or mitigations, and monitor for suspicious activity related to git commands.

Technical summary

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands. This vulnerability allows for command injection attacks, emphasizing the need for users to update to version 3.1.51 or later and review their git command usage.

Defensive priority

GitPython users should prioritize patching to prevent command injection attacks.

Recommended defensive actions

• Update GitPython to version 3.1.51 or later
• Review and restrict git command usage
• Monitor for suspicious activity
• Perform an inventory of systems using GitPython
• Review compensating controls for exposed systems
• Plan for vendor-supported updates or mitigations
• Track exceptions and retest remediated assets

Evidence notes

The CVE record indicates that GitPython before 3.1.51 contains an incomplete command injection blocklist. The NVD entry is currently Received. Further review of git's long-option prefix abbreviation feature and potential bypass vectors is recommended. Users should verify their current version and assess exposure based on this vulnerability. Defensive measures should include monitoring for suspicious activity and restricting git command usage.

Official resources