Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-01T12:22:16 gitpython: GitPython: Command Injection via Git option prefix abbreviation 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE-78

GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.

A flaw was found in GitPython. This vulnerability stems from an incomplete command injection blocklist that fails to account for Git's long-option prefix abbreviation feature. An attacker can bypass existing security measures by using abbreviated option names, which Git then resolves to dangerous options. This allows for the execution of arbitrary commands, leading to potential arbitrary code execution.

Red Hat Hardened Images 2026-07-23T00:00:00Z RHSA-2026:44416 llvm-main-22.1.8-4.1.hum1 Red Hat Hardened Images 2026-07-25T00:00:00Z RHSA-2026:45785 swift-lang-main-6.3.3-0.1.1.hum1 Red Hat Hardened Images 2026-07-26T00:00:00Z RHSA-2026:45940 llvm21-main-21.1.8-8.hum1 Exploit Intelligence Affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Migration Toolkit for Applications 8 Affected mta/mta-solution-server-rhel9 Pen Drive Powered by Red Hat Lightspeed Affected pen-drive/pen-drive-scanner-rhel9 Pen Drive Powered by Red Hat Lightspeed Affected pen-drive/pen-drive-scanner-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-tpu-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-24/controller-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-24/hub-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-25/controller-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-25/hub-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/controller-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/hub-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/controller-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/hub-rhel9 Red Hat Ansible Automation Platform 2 Affected automation-controller Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-gaudi-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rhelai3/disk-image-cuda-rhel9 Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cpu-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-cuda130-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda128-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenStack Platform 16.2 Affected GitPython Red Hat OpenStack Platform 17.1 Affected GitPython Red Hat Satellite 6 Affected satellite/iop-vmaas-rhel9 Red Hat Satellite 6 Affected satellite/iop-vulnerability-engine-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-67325 https://nvd.nist.gov/vuln/detail/CVE-2026-67325 https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation