{"id":"CVE-2026-67325","title":"GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature","summary":"GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uplo…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-78","CWE-184"],"published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325","references":[{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67325.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-67325"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2509975"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67325"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325"},{"url":"https://access.redhat.com/errata/RHSA-2026:59135"},{"url":"https://access.redhat.com/errata/RHSA-2026:59136"},{"url":"https://access.redhat.com/errata/RHSA-2026:59159"},{"url":"https://access.redhat.com/errata/RHSA-2026:59155"},{"url":"https://access.redhat.com/errata/RHSA-2026:44416"},{"url":"https://access.redhat.com/errata/RHSA-2026:45940"},{"url":"https://access.redhat.com/errata/RHSA-2026:45785"},{"url":"https://access.redhat.com/errata/RHSA-2026:63372"},{"url":"https://access.redhat.com/errata/RHSA-2026:63334"},{"url":"https://access.redhat.com/errata/RHSA-2026:63354"},{"url":"https://access.redhat.com/errata/RHSA-2026:63337"},{"url":"https://github.com/gitpython-developers/GitPython/pull/2161"},{"url":"https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285"},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51"},{"url":"https://github.com/advisories/GHSA-2f96-g7mh-g2hx"},{"url":"https://github.com/gitpython-developers/GitPython"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"url":"https://pypi.org/project/gitpython"},{"url":"https://access.redhat.com/errata/RHSA-2026:67279"},{"url":"https://access.redhat.com/errata/RHSA-2026:71114"},{"url":"https://access.redhat.com/errata/RHSA-2026:71113"},{"url":"https://access.redhat.com/errata/RHSA-2026:71210"},{"url":"https://access.redhat.com/errata/RHSA-2026:71179"},{"url":"https://access.redhat.com/errata/RHSA-2026:73987"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"}],"tags":["nvd","csaf","vex","red-hat","ghsa","pip","osv","cve.org","exploit-available"],"ingestedAt":"2026-08-02T07:18:02.241Z","epss":0.02209,"epssPercentile":0.825,"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","affected":["exploit_intelligence","migration_toolkit_for_applications 8","ai_inference_server","ansible_automation_platform 2","enterprise_linux_ai_rhel_ai 3","openshift_ai_rhoai","ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","ansible_automation_platform 2.5","ansible_automation_platform 2.6","hardened_images","satellite 6.18","satellite 6.19"],"patched":["ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","ansible_automation_platform 2.5","ansible_automation_platform 2.6","hardened_images","satellite 6.18","satellite 6.19"],"aliases":["GHSA-2f96-g7mh-g2hx","PYSEC-2026-3836"],"ecosystem":"pip","exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-08-05T03:56:16.576389Z"},"slug":"CVE-2026-67325","body":"## Overview\n\nGitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:59135** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59135)\n- **RHSA-2026:59136** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59136)\n- **RHSA-2026:59159** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59159)\n- **RHSA-2026:59155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59155)\n- **RHSA-2026:44416** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44416)\n- **RHSA-2026:45940** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:45940)\n- **RHSA-2026:45785** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:45785)\n- **RHSA-2026:63372** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63372)\n- **RHSA-2026:63334** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63334)\n- **RHSA-2026:63354** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63354)\n- **RHSA-2026:63337** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63337)\n- **Red Hat VEX** · Important · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Exploit Intelligence, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67325.json)\n- **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126)\n- **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279)\n- **RHSA-2026:71114** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71114)\n- **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113)\n- **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210)\n- **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179)\n\n## Package advisory (CVE-2026-67325)\n\nAffected packages:\n\n- `GitPython <= 3.1.50`\n\nPatched in:\n\n- `GitPython 3.1.51`\n\nSource: https://github.com/advisories/GHSA-2f96-g7mh-g2hx","depth":"midnight","depthScore":61,"depthScoreParts":{"impact":48.4,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":218205,"id":"CVE-2026-67325","ts":1791478558369,"field":"exploit_available","old":"false","new":"true"}]}