CVE-2026-67323 describes multiple command injection and arbitrary file manipulation vulnerabilities in GitPython prior to version 3.1.51. The vulnerabilities arise because Repo.archive() and git.ls_remote() methods fail to properly sanitize Git options passed as keyword arguments, allowing injection of commands via options like --exec or --upload-pack. Furthermore, Repo.iter_commits() and Repo.blame() do not validate leading-dash revision arguments, permitting a revision argument such as --output=<path> to cause Git to open and truncate arbitrary files. Successful exploitation requires that an application using GitPython passes attacker-controlled input to these vulnerable methods.

An attacker who can control arguments passed to the affected GitPython methods may execute arbitrary commands on the host system or cause arbitrary file truncation. This can lead to unauthorized code execution and potential data loss or corruption. The vulnerability is rated high severity with a CVSS 4.0 score of 8.6, reflecting the significant impact of remote command injection and file manipulation without requiring user interaction or privileges.

A fix is available in GitPython version 3.1.51. Users and developers should upgrade to version 3.1.51 or later to remediate these vulnerabilities. Until upgraded, applications should avoid passing untrusted or attacker-controlled arguments to the vulnerable methods (Repo.archive(), git.ls_remote(), Repo.iter_commits(), and Repo.blame). No official patch or temporary fix details are provided beyond upgrading to the fixed version.