Vulnerability Description
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-
- https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-ungu
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-
FAQ
What is CVE-2026-67323?
CVE-2026-67323 is a vulnerability with a CVSS score of 8.4 (HIGH). GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-p...
How severe is CVE-2026-67323?
CVE-2026-67323 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-67323?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.