CVE-2026-67325 is an OS command injection vulnerability in GitPython prior to version 3.1.51. The issue arises because the blocklist intended to prevent unsafe git command options does not account for git's long-option prefix abbreviation feature. Attackers can exploit this by using abbreviated option names such as 'upload_p' instead of 'upload_pack', which git interprets as the full dangerous option, enabling arbitrary command execution.

Successful exploitation allows an attacker with limited privileges to execute arbitrary OS commands via crafted git options that bypass the blocklist. This can lead to high impact including system compromise or unauthorized actions on the host running the vulnerable GitPython version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using vulnerable GitPython versions or restrict usage to trusted inputs only.