Security Advisory

CVE-2026-67325

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-01 12:22:16

Last updated 2026-08-01 12:22:16

Assigner VulnCheck

CVSS score not scored

State PUBLISHED

Description

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

← Browse all CVEs View on cve.org ↗