Fluid Attacks Database

Description

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	python-git	=3.1.30-1 \|\| =3.1.30-1+deb12u2 \|\| =3.1.36-1 \|\| =3.1.37-1 \|\| =3.1.37-2 \|\| =3.1.37-3 \|\| =3.1.44-1 \|\| =3.1.45-1 \|\| =3.1.46-1 \|\| =3.1.50-1 \|\| =3.1.61-1 \|\| =3.1.62-1 \|\| =3.1.62-2 \|\| =3.1.62-3 \|\| =3.2.1-1	-
pypi	gitpython	>=0 <3.1.51	3.1.51
debian 14	python-git	=3.1.44-1 \|\| =3.1.45-1 \|\| =3.1.46-1 \|\| =3.1.50-1 \|\| >=0 <3.1.61-1	3.1.61-1
debian 13	python-git	=3.1.44-1 \|\| =3.1.45-1 \|\| =3.1.46-1 \|\| =3.1.50-1 \|\| =3.1.61-1 \|\| =3.1.62-1 \|\| =3.1.62-2 \|\| =3.1.62-3 \|\| =3.2.1-1	-

Aliases

1. CVE-2026-673252. NVD-2026-673253. OSV-DEBIAN-2026-673254. OSV-2026-673255. GHSA-2f96-g7mh-g2hx6. GCVE-2026-673257. SECURITY-TRACKER-CVE-2026-67325

References

1. https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx2. https://github.com/gitpython-developers/GitPython/pull/21613. https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad2854. https://github.com/gitpython-developers/GitPython/releases/tag/3.1.515. https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.