Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-01T12:22:18 gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-88

GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=<path> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.

A flaw was found in GitPython where it fails to properly sanitize dangerous Git options. This vulnerability allows an attacker to inject arbitrary commands when using functions like Repo.archive() and git.ls_remote(), potentially leading to arbitrary code execution. Additionally, functions such as Repo.iter_commits() and Repo.blame() do not validate revision arguments, which could allow an attacker to truncate arbitrary files. Exploitation requires an application to pass attacker-controlled input directly to these vulnerable methods.

Red Hat Hardened Images 2026-07-23T00:00:00Z RHSA-2026:44416 llvm-main-22.1.8-4.1.hum1 Red Hat Hardened Images 2026-07-25T00:00:00Z RHSA-2026:45785 swift-lang-main-6.3.3-0.1.1.hum1 Red Hat Hardened Images 2026-07-26T00:00:00Z RHSA-2026:45940 llvm21-main-21.1.8-8.hum1 Exploit Intelligence Affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Migration Toolkit for Applications 8 Affected mta/mta-solution-server-rhel9 Pen Drive Powered by Red Hat Lightspeed Affected pen-drive/pen-drive-scanner-rhel9 Pen Drive Powered by Red Hat Lightspeed Affected pen-drive/pen-drive-scanner-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-tpu-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-24/controller-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-24/hub-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-25/controller-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-25/hub-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/controller-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/hub-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/controller-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/hub-rhel9 Red Hat Ansible Automation Platform 2 Affected automation-controller Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda128-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenStack Platform 16.2 Affected GitPython Red Hat OpenStack Platform 17.1 Affected GitPython Red Hat Satellite 6 Affected satellite/iop-vmaas-rhel9 Red Hat Satellite 6 Affected satellite/iop-vulnerability-engine-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-67323 https://nvd.nist.gov/vuln/detail/CVE-2026-67323 https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options