CVE-2026-67325: Gitpython Project Gitpython

High severity, CVSS 8.8. EPSS: 2.2% chance of exploitation in the next 30 days.

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

Affected products

• Gitpython Project Gitpython: before 3.1.51 (fixed in 3.1.51)

Published 2026-08-01. Last modified 2026-09-03.