Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.8, published 1 August 2026.

Which products and versions are affected?

GitPython Developers GitPython < 3.1.51.

Is there a fix for This vulnerability?

A patch was published on 2026: Fix available in GitPython 3.1.51 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

GitPython command injection via git long-option prefix abbreviation bypass

Q: Is there a fix for This vulnerability?

A patch was published on 2026: Fix available in GitPython 3.1.51 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 8.8 · Published 2026-08-01

GitPython is a Python library used by many applications to interact with Git repositories. It implements a blocklist to prevent attackers from passing dangerous git options that could lead to command execution. This vulnerability allows attackers to bypass that blocklist by using abbreviated option names (like `upload_p` instead of `upload_pack`), which Git then resolves and executes, enabling arbitrary command execution on systems using affected GitPython versions.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.8, published 1 August 2026.
Which products and versions are affected?: GitPython Developers GitPython < 3.1.51.
Is there a fix for This vulnerability?: A patch was published on 2026: Fix available in GitPython 3.1.51 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from an incomplete fix to CVE-2026-42215. GitPython's check_unsafe_options() method canonicalizes option names by converting underscores to hyphens and performs exact-match lookups against a blocklist of dangerous git options (--upload-pack, --receive-pack, --config, --exec, etc.). However, Git's CLI parser accepts unambiguous prefix abbreviations of long options—so `--upload-p`, `--upload-pa`, and `--upload-pac` all resolve to `--upload-pack`. The guard does not model this abbreviation grammar, allowing shortened kwarg keys like `upload_p` to pass validation and reach git as `--upload-p=<value>`, which is then resolved to the blocked `--upload-pack` option. Exploitation requires a host application that flows attacker-controlled kwarg keys into GitPython's clone, fetch, pull, or push methods with the default `allow_unsafe_options=False` setting. The fix is available in GitPython 3.1.51 and later.

Affected products

GitPython Developers GitPython < 3.1.51

Timeline

2026-07-12: disclosed: Original advisory GHSA-2f96-g7mh-g2hx published
2026-08-01: disclosed: Duplicate advisory GHSA-6r2r-ww24-7h52 published; CVE-2026-67325 assigned by NVD
2026-09-08: other: GHSA-6r2r-ww24-7h52 withdrawn as duplicate of GHSA-2f96-g7mh-g2hx
2026: patched: Fix available in GitPython 3.1.51

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.