CVE-2026-67323
2 advisories.
PyPI/gitpython CVE-2026-67323: high 8.4, EPSS 1.25%
GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
Action: Upgrade gitpython to 3.1.51 or later.
pip install gitpython==3.1.51Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.1.51 | - |
Fixed versions
| 3.1.51 |
Sources
- osv: GHSA-956x-8gvw-wg5v
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v
- https://nvd.nist.gov/vuln/detail/CVE-2026-67323
- https://github.com/gitpython-developers/GitPython/pull/2163
- https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738
- https://github.com/gitpython-developers/GitPython
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51
- https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options
CVE-2026-67323 · published · modified · JSON
PyPI/gitpython CVE-2026-67323: high 8.4, EPSS 1.25%
GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`
Action: Upgrade gitpython to 3.1.51 or later.
pip install gitpython==3.1.51Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.1.51 | - |
Fixed versions
| 3.1.51 |
Sources
- osv: PYSEC-2026-3839
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v
- https://nvd.nist.gov/vuln/detail/CVE-2026-67323
- https://github.com/gitpython-developers/GitPython/pull/2163
- https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738
- https://github.com/gitpython-developers/GitPython
- https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51
- https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options
- https://pypi.org/project/gitpython
- https://github.com/advisories/GHSA-956x-8gvw-wg5v
CVE-2026-67323 · published · modified · JSON