Vulnerabilities

GitPython's GitConfigParser contains a configuration-injection flaw (CWE-88/CWE-94) in its read-then-write round trip: multi-line values parsed from an on-disk config file using git's standard backslash-continuation syntax are decoded into Python strings with embedded newlines, and when the parser later rewrites the file, write_section() serializes them as a bare, unquoted newline-plus-tab continuation that real git parses as separate top-level config lines. The recently added UNSAFE_CONFIG_CHARS_RE safety guard only applies to values passed directly to set()/set_value()/add_value()/add_section(), never to values loaded from disk via _read(), so any unrelated write can turn a dormant value into a live directive such as core.hooksPath = <attacker-controlled path>. An attacker who can plant such a value in a config file that a GitPython-based application later rewrites gains arbitrary code execution, because git will execute the attacker's hook programs with the privileges of the user running GitPython. Developers, CI/CD systems, and pip-packaged tools that embed GitPython and rewrite git config files are affected, with GitPython 3.1.58 at HEAD confirmed vulnerable. No public PoC exists, it is not in CISA KEV, and EPSS assigns only a 0.4% probability of exploitation within 30 days, so no exploitation is currently known.

Do: Monitor GitPython for a patched release beyond 3.1.58/commit 9729ed3b (no fixed version is identified in the available data) and upgrade as soon as one is published. In the interim, avoid letting GitConfigParser rewrite config files that may contain multi-line (backslash-continuation) values, audit managed .git/config and related files for values with embedded newlines or unexpected trailing fragments like hooksPath, and restrict write access to those files to trusted principals.

GitPython before 3.1.58 contains a flaw (CWE-88) in its check_unsafe_options guard, which is meant to block unsafe git options while allow_unsafe_options is set to its default value of False. The guard can be bypassed by combining a single-character keyword argument with split_single_char_options=False, causing GitPython to emit a joined token that git itself parses as an --upload-pack option. An attacker who can influence the kwargs passed to guarded methods such as clone_from can therefore inject --upload-pack and achieve arbitrary OS command execution, despite the library's default safe configuration. Any Python application, service, or pipeline built on the pip-installed GitPython library that passes attacker-controlled or remotely influenced arguments into its git wrapper methods is affected. A public proof-of-concept reference exists via the project's GitHub security advisory (GHSA-wvpp-8hx9-p66j); there is no evidence of in-the-wild exploitation yet, and EPSS puts 30-day exploitation probability at roughly 0.6%.

Do: Upgrade to GitPython 3.1.58 or later via pip as soon as possible. Audit application code paths where user or remote input flows into kwargs of guarded GitPython methods (e.g., clone_from), and avoid combining split_single_char_options=False with single-character keyword arguments until patched. No in-the-wild exploitation is confirmed, but given the public advisory, prioritize updates for internet-facing services that wrap git operations.

CVE-2026-67325 is a command injection flaw (CWE-78) in GitPython, a Python library for running Git commands: versions before 3.1.51 use an incomplete blocklist of unsafe git options that does not account for git's long-option prefix abbreviation feature. An attacker triggers it by supplying an abbreviated option name such as 'upload_p' in place of 'upload_pack' in data that reaches GitPython's git command invocations; the abbreviated form evades the unsafe-options guard while git still resolves it to the dangerous option, enabling arbitrary command execution. Per the CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N), the attack is network-based, requires low privileges, and no user interaction, and successful exploitation yields high impact to confidentiality, integrity, and availability with the privileges of the process invoking GitPython. Any environment running GitPython versions before 3.1.51 installed via pip is affected, with risk concentrated in CI/CD pipelines, automation, and services that pass attacker-controlled repository data or arguments into git commands. There are no reports of in-the-wild exploitation (not listed in CISA KEV), EPSS is 1.9% over 30 days (78th percentile), and one public advisory/exploit reference exists (GHSA-2f96-g7mh-g2hx).

Do: Upgrade to GitPython 3.1.51 or later, which closes the abbreviated-option bypass in the unsafe-options guard. Where patching is delayed, strictly validate and restrict attacker-controlled values (refs, URLs, and option strings) passed into GitPython commands so abbreviated long options cannot evade the blocklist. Given the public advisory reference and 1.9% EPSS, prioritize patching internet-facing or multi-tenant services that execute git operations on untrusted repository data.