THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-67323 (HIGH 8.4) — GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits()

[NVD] CVE-2026-67323 (HIGH 8.4) — GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits()

mednvdPublished 2026-08-01

CVE-2026-67323 CVSS: 8.4 HIGH Published: 2026-08-01T13:17:02.637

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revisio

Indicators of compromise

CVE-2026-67323cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-67323