--- id: CVE-2026-67325 title: >- GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature summary: >- GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like uplo… severity: high cvss: 8.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-78 - CWE-184 published: '2026-08-01' updated: '2026-08-01' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67325' references: - url: >- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx label: disclosure@vulncheck.com - url: >- https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation label: disclosure@vulncheck.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67325.json - url: 'https://access.redhat.com/security/cve/CVE-2026-67325' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2509975' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67325' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67325' - url: 'https://access.redhat.com/errata/RHSA-2026:59135' - url: 'https://access.redhat.com/errata/RHSA-2026:59136' - url: 'https://access.redhat.com/errata/RHSA-2026:59159' - url: 'https://access.redhat.com/errata/RHSA-2026:59155' - url: 'https://access.redhat.com/errata/RHSA-2026:44416' - url: 'https://access.redhat.com/errata/RHSA-2026:45940' - url: 'https://access.redhat.com/errata/RHSA-2026:45785' - url: 'https://access.redhat.com/errata/RHSA-2026:63372' - url: 'https://access.redhat.com/errata/RHSA-2026:63334' - url: 'https://access.redhat.com/errata/RHSA-2026:63354' - url: 'https://access.redhat.com/errata/RHSA-2026:63337' - url: 'https://github.com/gitpython-developers/GitPython/pull/2161' - url: >- https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285 - url: 'https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51' - url: 'https://github.com/advisories/GHSA-2f96-g7mh-g2hx' - url: 'https://github.com/gitpython-developers/GitPython' - url: 'https://access.redhat.com/errata/RHSA-2026:65126' - url: 'https://pypi.org/project/gitpython' - url: 'https://access.redhat.com/errata/RHSA-2026:67279' - url: 'https://access.redhat.com/errata/RHSA-2026:71114' - url: 'https://access.redhat.com/errata/RHSA-2026:71113' - url: 'https://access.redhat.com/errata/RHSA-2026:71210' - url: 'https://access.redhat.com/errata/RHSA-2026:71179' - url: 'https://access.redhat.com/errata/RHSA-2026:73987' - url: 'https://access.redhat.com/errata/RHSA-2026:84734' tags: - nvd - csaf - vex - red-hat - ghsa - pip - osv - cve.org - exploit-available ingestedAt: '2026-08-02T07:18:02.241Z' epss: 0.02209 epssPercentile: 0.825 vendor: Red Hat product: Red Hat OpenShift AI (RHOAI) affected: - exploit_intelligence - migration_toolkit_for_applications 8 - ai_inference_server - ansible_automation_platform 2 - enterprise_linux_ai_rhel_ai 3 - openshift_ai_rhoai - ansible_automation_platform_2_5_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - hardened_images - satellite 6.18 - satellite 6.19 patched: - ansible_automation_platform_2_5_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - hardened_images - satellite 6.18 - satellite 6.19 aliases: - GHSA-2f96-g7mh-g2hx - PYSEC-2026-3836 ecosystem: pip exploitAvailable: true ssvc: exploitation: poc automatable: 'no' technicalImpact: total timestamp: '2026-08-05T03:56:16.576389Z' --- ## Overview GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:59135** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59135) - **RHSA-2026:59136** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59136) - **RHSA-2026:59159** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59159) - **RHSA-2026:59155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59155) - **RHSA-2026:44416** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:44416) - **RHSA-2026:45940** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:45940) - **RHSA-2026:45785** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:45785) - **RHSA-2026:63372** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63372) - **RHSA-2026:63334** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63334) - **RHSA-2026:63354** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63354) - **RHSA-2026:63337** · Red Hat · fixed in: Red Hat Satellite 6.19 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63337) - **Red Hat VEX** · Important · affected: Exploit Intelligence, Migration Toolkit for Applications 8, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux AI (RHEL AI) 3, Exploit Intelligence, … · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67325.json) - **RHSA-2026:65126** · Red Hat · fixed in: Red Hat OpenShift AI 2.25 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65126) - **RHSA-2026:67279** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67279) - **RHSA-2026:71114** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71114) - **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113) - **RHSA-2026:71210** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71210) - **RHSA-2026:71179** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71179) ## Package advisory (CVE-2026-67325) Affected packages: - `GitPython <= 3.1.50` Patched in: - `GitPython 3.1.51` Source: https://github.com/advisories/GHSA-2f96-g7mh-g2hx