VulnSocial

CVE-2026-67323Disclosure(gitpython_project / gitpython)

LOWCVSS 8.6 · HIGH

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Patch gitpython_project gitpython systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.

gitpython_project CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-77

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • gitpython

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • 3 total mentions across 1 day

Affected systems

Vendors
gitpython_project
Products
gitpython

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-08-01: 3Patch / Workaround · 2026-08-01: 1Technical Details · 2026-08-01: 308-01
Signal classification1 categories
Disclosure
3100.0%
Referenced assets3 URLs
Full discourse3 posts
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-67323 GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and http://git.ls_remote(), allowing command injection via… https://www.cve.org/CVERecord?id=CVE-2026-67323 ----- Traducción: C… http://infoflow.cloud`

    Post summary

    The post announces a CVE-2026-67323 that allows command injection in GitPython via keyword arguments in Repo.archive() and git.ls_remote(), providing specific technical details but no evidence of exploitation or patches.

    0000037
    96 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-67323 GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and http://git.ls_remote(), allowing command injection via… https://www.cve.org/CVERecord?id=CVE-2026-67323

    Post summary

    The post discloses CVE‑2026‑67323, a command‑injection vulnerability in GitPython versions before 3.1.51 triggered via dangerous Git options, but does not provide a PoC, exploit, or remediation.

    00000725
    57.9K followersView on X
  • Upwind Security MDR@UpwindMDR
    Disclosure

    🚨High - GitPython Git Option Injection & Arbitrary File Truncation (CVE-2026-67323) GitPython <3.1.51 fails to restrict dangerous git options in Repo.archive() / http://git.ls_remote() kwargs, enabling injection of flags like --exec/--upload-pack to reach arbitrary command execution. It also accepts leading-dash revision args in Repo.iter_commits() / Repo.blame(), allowing --output= to make git open/truncate attacker-chosen files; requires attacker-controlled args. 👉Affected: GitPython < 3.1.51 | Upgrade to 3.1.51

    Post summary

    An identified high‑severity CVE‑2026‑67323 in GitPython versions below 3.1.51 permits arbitrary command execution through option injection and file truncation; upgrading to 3.1.51 mitigates the risk.

    0000070
    278 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appgitpython_projectgitpython-python-

Explore more

Back to dashboardgitpython_project CVEsgitpython vulnerabilities