Source: python-git
Version: 3.1.50-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for python-git.
CVE-2026-67322[0]:
| GitPython before 3.1.52 is vulnerable to environment-variable
| exfiltration in Repo.clone_from(). The caller-supplied remote URL is
| passed through Git.polish_url(), which on non-Cygwin platforms calls
| os.path.expandvars() on the URL before invoking git clone. An
| attacker who controls the clone URL can embed $NAME or ${NAME}
| tokens that are expanded to the values of the hosting process's
| environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN).
| The resulting URL, now containing the secret, is transmitted over
| the network to an attacker-controlled host during the clone attempt,
| disclosing the secret.
CVE-2026-67323[1]:
| GitPython before 3.1.51 fails to guard against dangerous Git options
| passed as keyword arguments in Repo.archive() and git.ls_remote(),
| allowing command injection via options such as --exec/--upload-pack
| (leading to arbitrary command execution). Additionally,
| Repo.iter_commits() and Repo.blame() do not check for leading-dash
| revision arguments, so a revision like --output=<path> can cause Git
| to open and truncate an arbitrary file. Exploitation requires an
| application that passes attacker-controlled arguments to these
| methods.
CVE-2026-67324[2]:
| GitPython 3.1.50 fails to recognize joined short-option forms such
| as -u<value> (the short form of --upload-pack=<value>) when
| enforcing its default unsafe-option gate. When an application passes
| attacker-influenced clone options into Repo.clone_from(...,
| multi_options=..., allow_unsafe_options=False), an attacker can
| supply -u<helper> to bypass the gate that blocks --upload-pack/-u,
| causing Git to execute the specified helper command during clone.
| Fixed in 3.1.51.
CVE-2026-67325[3]:
| GitPython before 3.1.51 contains an incomplete command injection
| blocklist that fails to account for git's long-option prefix
| abbreviation feature. Attackers can bypass the unsafe options guard
| by using abbreviated option names like upload_p instead of
| upload_pack, which git resolves to dangerous options and executes
| arbitrary commands.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-67322
https://www.cve.org/CVERecord?id=CVE-2026-67322
[1] https://security-tracker.debian.org/tracker/CVE-2026-67323
https://www.cve.org/CVERecord?id=CVE-2026-67323
[2] https://security-tracker.debian.org/tracker/CVE-2026-67324
https://www.cve.org/CVERecord?id=CVE-2026-67324
[3] https://security-tracker.debian.org/tracker/CVE-2026-67325
https://www.cve.org/CVERecord?id=CVE-2026-67325
Regards,
Salvatore
