CVE-2026-67325 Overview
CVE-2026-67325 affects GitPython versions before 3.1.51. The library maintains a blocklist of unsafe git options to prevent command injection. That blocklist fails to account for git's long-option prefix abbreviation feature. Attackers can supply abbreviated option names such as upload_p in place of upload_pack. Git resolves the abbreviation to the dangerous option and executes attacker-controlled commands. The flaw is classified under [CWE-78] OS Command Injection.
Critical Impact
Authenticated attackers who influence GitPython option arguments can execute arbitrary operating system commands, leading to full compromise of confidentiality, integrity, and availability.
Affected Products
- GitPython versions prior to 3.1.51
- Python applications embedding GitPython for repository operations
- Automation and CI/CD tooling that passes user-influenced input to GitPython APIs
Discovery Timeline
- 2026-08-01 - CVE-2026-67325 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-67325
Vulnerability Analysis
GitPython invokes the git command line binary to perform repository operations. To reduce the risk of argument injection, the library maintains an internal blocklist of options considered unsafe, including --upload-pack and --receive-pack. These options let a caller specify an arbitrary executable that git will run against the target repository.
Git's argument parser accepts unambiguous prefix abbreviations for long options. --upload-p resolves to --upload-pack when no other option shares that prefix. GitPython's blocklist compares against the full option name only. Abbreviated forms pass the guard and reach the git process unchanged. Git then executes the attacker-specified command.
The underlying weakness is incomplete input validation on a security-critical allowlist boundary. See the GitHub Security Advisory and the VulnCheck Advisory for full technical background.
Root Cause
The blocklist performs literal string matching against known dangerous option names. Git accepts any unique prefix as equivalent to the full option. Because GitPython does not normalize or expand abbreviations before comparison, dangerous options can be smuggled past validation.
Attack Vector
An attacker with the ability to influence option arguments passed to GitPython, for example through repository URLs, remote names, or user-supplied clone parameters, submits an abbreviated form of an unsafe option. GitPython forwards the argument to git. Git executes the specified helper program, giving the attacker arbitrary command execution in the context of the calling process.
No verified exploitation code is available. Refer to the security advisories linked above for proof-of-concept details.
Detection Methods for CVE-2026-67325
Indicators of Compromise
- Unexpected child processes spawned by Python interpreters running GitPython workloads, especially shells, network utilities, or interpreters.
- Git invocations containing abbreviated long options such as --upload-p, --receive-p, or other truncated forms of --upload-pack and --receive-pack.
- Outbound network connections initiated from build agents, git hooks, or web application workers immediately after repository operations.
Detection Strategies
- Inspect process command lines for git invocations that include long-option prefixes shorter than the full canonical option name.
- Alert on GitPython-driven processes that execute non-git binaries as children.
- Review application logs for user-supplied inputs that reach Repo.clone_from, Remote, or similar GitPython APIs without strict allowlisting.
Monitoring Recommendations
- Instrument CI/CD runners and web workers with EDR telemetry that records full process command lines and parent-child relationships.
- Track installed GitPython versions across your Python fleet and flag any release below 3.1.51.
- Correlate repository clone events with subsequent process, file, and network activity to surface post-exploitation behavior.
How to Mitigate CVE-2026-67325
Immediate Actions Required
- Upgrade GitPython to version 3.1.51 or later across all applications, containers, and virtual environments.
- Audit code paths that pass externally influenced strings to GitPython and enforce strict allowlists on remote URLs and option values.
- Rotate credentials and secrets accessible to any host that ran a vulnerable GitPython version with untrusted input.
Patch Information
The GitPython maintainers addressed the incomplete blocklist in release 3.1.51. The fix normalizes option arguments and rejects abbreviated forms of unsafe options before invoking git. Full details are documented in the GitHub Security Advisory GHSA-2f96-g7mh-g2hx.
Workarounds
- Reject any user-supplied argument that begins with -- before passing values to GitPython until the upgrade is deployed.
- Run GitPython workloads under least-privilege service accounts with no ability to reach sensitive credentials or internal networks.
- Isolate repository operations in sandboxed containers with restricted egress and read-only filesystems.
# Upgrade GitPython to the patched release
pip install --upgrade 'GitPython>=3.1.51'
# Verify the installed version
python -c "import git; print(git.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
