CVE-2026-67325
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Aug 01, 2026
Vendor
unknown
Description
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.