GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

🗓️ 10 Sep 2026 09:44:50Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 4 Views

Command injection in GitPython via long-option prefix abbreviation bypassing CVE-2026-42215 fix.

Reporter	Title	Published	Views	Family All 152
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	27 May 202616:03	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for May 2026	12 Jun 202622:52	–	ibm
ATTACKERKB	CVE-2026-42215	7 May 202618:17	–	attackerkb
ATTACKERKB	CVE-2026-67325	1 Aug 202612:22	–	attackerkb
AlpineLinux	CVE-2026-42215	7 May 202618:17	–	alpinelinux
AlpineLinux	CVE-2026-67325	1 Aug 202612:22	–	alpinelinux
BDU FSTEC	The vulnerability of the functions Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push() in the Python library for interacting with Git repositories, GitPython, allows a malicious actor to execute arbitrary commands.	13 May 202600:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the `check_unsafe_options()` function in the Python library for interacting with Git repositories, GitPython, allows a malicious actor to execute arbitrary code.	5 Aug 202600:00	–	bdu_fstec
Chainguard	CVE-2026-42215 vulnerabilities	6 May 202619:17	–	cgr
Chainguard	CVE-2026-67325 vulnerabilities	9 Sep 202620:54	–	cgr

Vulners

Node

pypi gitpythonRange0–3.1.51

Source	Link
github	www.github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-67325
github	www.github.com/gitpython-developers/GitPython/pull/2161
github	www.github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285
github	www.github.com/gitpython-developers/GitPython
github	www.github.com/gitpython-developers/GitPython/releases/tag/3.1.51
vulncheck	www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation
pypi	www.pypi.org/project/gitpython
github	www.github.com/advisories/GHSA-2f96-g7mh-g2hx

10 Sep 2026 11:02Current

CVSS 3.18.8

CVSS 48.7

EPSS0.01854

SSVC