Vulnerability - CVE-2026-67325

›

›vulnerability›CVE-2026-67325

Name

CVE-2026-67325

Source

NVD ( link)Debian ( link)

Description

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

CWEs

Published Date

Aug 1, 2026

Updated Date

Sep 3, 2026

Workaround

-

Advisories

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hxExploit

https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviationThird Party Advisory

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hxExploit

Analysis#

Affected Component

Analysis

Vulnerability Ratings#

8.7

CVSSv4

8.8

CVSSv31

NaN

other

Others affected component#

Name

Project

Project Version

Version

Status

yocto

master

3.2.0

Not Affected