[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-67323":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":52,"aliases":70,"duplicate_of":9,"upstream":81,"downstream":86,"duplicates":99,"related":100,"reserved_at":9,"published_at":104,"modified_at":105,"state":106,"summary":107,"references_raw":115,"kevs":180,"epss":181,"epss_history":184,"metrics":332,"affected":356},"CVE-2026-67323","GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary command execution). Additionally, Repo.iter_commits() and Repo.blame() do not check for leading-dash revision arguments, so a revision like --output=\u003Cpath> can cause Git to open and truncate an arbitrary file. Exploitation requires an application that passes attacker-controlled arguments to these methods.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-77","Improper Neutralization of Special Elements used in a Command ('Command Injection')","The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.","weakness","Draft","Class","High",[20,24,28,32,36,40,44,48],{"id":21,"name":22,"techniques":23},"CAPEC-136","LDAP Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-15","Command Delimiters",[],{"id":29,"name":30,"techniques":31},"CAPEC-183","IMAP/SMTP Command Injection",[],{"id":33,"name":34,"techniques":35},"CAPEC-248","Command Injection",[],{"id":37,"name":38,"techniques":39},"CAPEC-40","Manipulating Writeable Terminal Devices",[],{"id":41,"name":42,"techniques":43},"CAPEC-43","Exploiting Multiple Input Interpretation Layers",[],{"id":45,"name":46,"techniques":47},"CAPEC-75","Manipulating Writeable Configuration Files",[],{"id":49,"name":50,"techniques":51},"CAPEC-76","Manipulating Web Input to File System Calls",[],[53,62],{"_key":54,"name":55,"source":56,"url":57,"maturity":58,"reliability_score":59,"verified":60,"type":9,"platforms":61,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_GITPYTHON-DEVELOPERS_GITPYTHON","Gitpython","github","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4","poc",0.3,false,[],{"_key":63,"name":64,"source":65,"url":66,"maturity":67,"reliability_score":68,"verified":60,"type":9,"platforms":69,"requires_auth":9,"exploitdb":9,"metasploit":9},"REF_B79CCB97DE955C0E","Exploit Reference (vulncheck.com)","reference","https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options","unknown",0.2,[],[71,72,73,74,75,76,77,78,79,80],"GHSA-956x-8gvw-wg5v","UBUNTU-CVE-2026-67323","DEBIAN-CVE-2026-67323","CGA-6gh5-ggxg-qxgr","CGA-g65f-6ghm-qrpq","CGA-r2h6-pwh9-wjmm","CGA-rvgh-fg27-9c32","PYSEC-2026-3839","CGA-3232-2582-g274","CGA-wmx3-3jwh-rr5m",[82,84],{"_key":83},"GHSA-4VPG-PFJ8-M33Q",{"_key":85},"GHSA-956X-8GVW-WG5V",[87,89,91,93,95,97],{"_key":88},"SUSE-SU-2026:4072-1",{"_key":90},"RHSA-2026:44416",{"_key":92},"RHSA-2026:45785",{"_key":94},"RHSA-2026:45940",{"_key":96},"RHSA-2026:59135",{"_key":98},"RHSA-2026:59136",[],[101,102],{"_key":88},{"_key":103},"CGA-78VW-9344-JHXG","2026-08-01T12:22:18.119Z","2026-08-14T16:50:52.083Z","Analyzed",{"cisa_kev":60,"cisa_ransomware":60,"cisa_vendor":9,"epss_severity":108,"epss_score":109,"severity":110,"severity_score":111,"severity_version":112,"severity_source":113,"severity_vector":114,"severity_status":106},"low",0.01037,"high",8.6,"v4.0","cve.org","CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",[116,130,134,138,142,147,151,155,159,164,168,172,176],{"url":117,"sources":118,"tags":124},"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v",[113,119,120,121,122,123],"nvd","osv_pypi","osv_ubuntu","osv_wolfi","osv_chainguard",[125,126,127,128,129],"Vendor Advisory","WEB","REPORT","Exploit","Advisory",{"url":66,"sources":131,"tags":132},[113,119,121,120,122,123],[133,127,128,126,129],"Third Party Advisory",{"url":135,"sources":136,"tags":137},"https://github.com/gitpython-developers/GitPython/pull/2163",[120,122],[126],{"url":139,"sources":140,"tags":141},"https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738",[120,122],[126],{"url":143,"sources":144,"tags":145},"https://github.com/gitpython-developers/GitPython",[120,122],[146],"PACKAGE",{"url":148,"sources":149,"tags":150},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51",[120,122],[126],{"url":152,"sources":153,"tags":154},"https://ubuntu.com/security/CVE-2026-67323",[121],[127],{"url":156,"sources":157,"tags":158},"https://www.cve.org/CVERecord?id=CVE-2026-67323",[121],[127],{"url":160,"sources":161,"tags":163},"https://security-tracker.debian.org/tracker/CVE-2026-67323",[162],"osv_debian",[129],{"url":165,"sources":166,"tags":167},"https://nvd.nist.gov/vuln/detail/CVE-2026-67323",[120,122,123],[129],{"url":169,"sources":170,"tags":171},"https://pypi.org/project/gitpython",[120],[146],{"url":173,"sources":174,"tags":175},"https://github.com/advisories/GHSA-956x-8gvw-wg5v",[120],[129],{"url":177,"sources":178,"tags":179},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67323.json",[122,123],[129],[],{"date":182,"score":109,"percentile":183},"2026-09-19",0.62413,[185,189,192,195,198,201,204,207,210,213,216,219,222,225,228,231,234,237,240,243,246,249,252,256,259,262,265,268,271,274,277,280,283,286,289,292,295,298,301,304,307,310,313,316,319,322,325,328,331],{"date":186,"score":187,"percentile":188},"2026-08-02",0.01016,0.59888,{"date":190,"score":187,"percentile":191},"2026-08-03",0.59899,{"date":193,"score":187,"percentile":194},"2026-08-04",0.59922,{"date":196,"score":187,"percentile":197},"2026-08-05",0.5995,{"date":199,"score":187,"percentile":200},"2026-08-06",0.59982,{"date":202,"score":187,"percentile":203},"2026-08-07",0.60025,{"date":205,"score":187,"percentile":206},"2026-08-08",0.60039,{"date":208,"score":187,"percentile":209},"2026-08-09",0.60037,{"date":211,"score":187,"percentile":212},"2026-08-10",0.60047,{"date":214,"score":187,"percentile":215},"2026-08-11",0.60113,{"date":217,"score":187,"percentile":218},"2026-08-12",0.60192,{"date":220,"score":187,"percentile":221},"2026-08-13",0.60225,{"date":223,"score":187,"percentile":224},"2026-08-14",0.60282,{"date":226,"score":187,"percentile":227},"2026-08-15",0.60374,{"date":229,"score":187,"percentile":230},"2026-08-16",0.60393,{"date":232,"score":187,"percentile":233},"2026-08-17",0.60396,{"date":235,"score":187,"percentile":236},"2026-08-18",0.60419,{"date":238,"score":187,"percentile":239},"2026-08-19",0.60571,{"date":241,"score":187,"percentile":242},"2026-08-20",0.60627,{"date":244,"score":187,"percentile":245},"2026-08-21",0.60669,{"date":247,"score":187,"percentile":248},"2026-08-22",0.60682,{"date":250,"score":187,"percentile":251},"2026-08-23",0.60195,{"date":253,"score":254,"percentile":255},"2026-08-24",0.00949,0.58556,{"date":257,"score":254,"percentile":258},"2026-08-25",0.58582,{"date":260,"score":254,"percentile":261},"2026-08-26",0.58648,{"date":263,"score":254,"percentile":264},"2026-08-27",0.58687,{"date":266,"score":254,"percentile":267},"2026-08-28",0.58183,{"date":269,"score":254,"percentile":270},"2026-08-29",0.58214,{"date":272,"score":254,"percentile":273},"2026-08-30",0.5877,{"date":275,"score":254,"percentile":276},"2026-08-31",0.58774,{"date":278,"score":254,"percentile":279},"2026-09-01",0.58797,{"date":281,"score":254,"percentile":282},"2026-09-02",0.58842,{"date":284,"score":254,"percentile":285},"2026-09-03",0.58864,{"date":287,"score":109,"percentile":288},"2026-09-04",0.61628,{"date":290,"score":109,"percentile":291},"2026-09-05",0.61162,{"date":293,"score":109,"percentile":294},"2026-09-06",0.61678,{"date":296,"score":109,"percentile":297},"2026-09-07",0.61685,{"date":299,"score":109,"percentile":300},"2026-09-08",0.61703,{"date":302,"score":109,"percentile":303},"2026-09-09",0.61878,{"date":305,"score":109,"percentile":306},"2026-09-10",0.61899,{"date":308,"score":109,"percentile":309},"2026-09-11",0.61927,{"date":311,"score":109,"percentile":312},"2026-09-12",0.61989,{"date":314,"score":109,"percentile":315},"2026-09-13",0.61985,{"date":317,"score":109,"percentile":318},"2026-09-14",0.62002,{"date":320,"score":109,"percentile":321},"2026-09-15",0.62069,{"date":323,"score":109,"percentile":324},"2026-09-16",0.62209,{"date":326,"score":109,"percentile":327},"2026-09-17",0.62276,{"date":329,"score":109,"percentile":330},"2026-09-18",0.62377,{"date":182,"score":109,"percentile":183},[333,341,345,347,350,352,354],{"source":113,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":334,"cvss_v4_0":340},{"baseScore":335,"baseSeverity":336,"vectorString":337,"impactScore":338,"exploitabilityScore":339},8.4,"HIGH","CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",9.8,6.4,{"baseScore":111,"baseSeverity":336,"vectorString":114,"impactScore":9,"exploitabilityScore":9},{"source":119,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":342,"cvss_v4_0":343},{"baseScore":335,"baseSeverity":336,"vectorString":337,"impactScore":338,"exploitabilityScore":339},{"baseScore":111,"baseSeverity":336,"vectorString":344,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":120,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":346,"cvss_v4_0":9},{"baseScore":335,"baseSeverity":9,"vectorString":337,"impactScore":338,"exploitabilityScore":339},{"source":121,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":348,"cvss_v4_0":349},{"baseScore":335,"baseSeverity":9,"vectorString":337,"impactScore":338,"exploitabilityScore":339},{"baseScore":111,"baseSeverity":9,"vectorString":114,"impactScore":9,"exploitabilityScore":9},{"source":162,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":351},{"baseScore":111,"baseSeverity":9,"vectorString":344,"impactScore":9,"exploitabilityScore":9},{"source":122,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":353},{"baseScore":111,"baseSeverity":9,"vectorString":114,"impactScore":9,"exploitabilityScore":9},{"source":123,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":355},{"baseScore":111,"baseSeverity":9,"vectorString":114,"impactScore":9,"exploitabilityScore":9},[357,369,378,383,387,401,406,415,421],{"ecosystem":358,"name":359,"vendor":360,"product":359,"cpe_part":9,"purl_type":361,"purl_namespace":360,"purl_name":359,"source":9,"versions":362},"Chainguard","checkov","chainguard","apk",[363],{"version":364,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":367,"version_end_type":368,"fixed_in":9},"lt3_3_8_r1",true,"ecosystem","3.3.8-r1","excluding",{"ecosystem":358,"name":370,"vendor":360,"product":370,"cpe_part":9,"purl_type":361,"purl_namespace":360,"purl_name":370,"source":9,"versions":371},"mlflow",[372,375],{"version":373,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":374,"version_end_type":368,"fixed_in":9},"lt3_14_0_r2","3.14.0-r2",{"version":376,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":377,"version_end_type":368,"fixed_in":9},"lt3_16_0_r0","3.16.0-r0",{"ecosystem":379,"name":359,"vendor":380,"product":359,"cpe_part":9,"purl_type":361,"purl_namespace":380,"purl_name":359,"source":9,"versions":381},"Wolfi","wolfi",[382],{"version":364,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":367,"version_end_type":368,"fixed_in":9},{"ecosystem":379,"name":370,"vendor":380,"product":370,"cpe_part":9,"purl_type":361,"purl_namespace":380,"purl_name":370,"source":9,"versions":384},[385,386],{"version":373,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":374,"version_end_type":368,"fixed_in":9},{"version":376,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":377,"version_end_type":368,"fixed_in":9},{"ecosystem":388,"name":389,"vendor":390,"product":389,"cpe_part":9,"purl_type":391,"purl_namespace":390,"purl_name":389,"source":9,"versions":392},"Debian","python-git","debian","deb",[393,395,396,397,398],{"version":394,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"version":394,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":394,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":394,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":399,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":400,"version_end_type":368,"fixed_in":9},"lt3_1_61_1","3.1.61-1",{"ecosystem":402,"name":389,"vendor":403,"product":389,"cpe_part":9,"purl_type":391,"purl_namespace":403,"purl_name":389,"source":9,"versions":404},"Ubuntu","ubuntu",[405],{"version":394,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":407,"vendor":408,"product":407,"cpe_part":409,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":410},"gitpython","gitpython_project","a",[411],{"version":412,"is_range":365,"range_type":413,"version_start":9,"version_start_type":9,"version_end":414,"version_end_type":368,"fixed_in":9},"lt3.1.51","cpe","3.1.51",{"ecosystem":9,"name":416,"vendor":417,"product":407,"cpe_part":409,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":418},"GitPython","gitpython-developers",[419],{"version":420,"is_range":365,"range_type":113,"version_start":9,"version_start_type":9,"version_end":414,"version_end_type":368,"fixed_in":9},"\u003C 3.1.51",{"ecosystem":422,"name":407,"vendor":422,"product":407,"cpe_part":9,"purl_type":423,"purl_namespace":9,"purl_name":407,"source":9,"versions":424},"PyPI","pypi",[425],{"version":426,"is_range":365,"range_type":366,"version_start":9,"version_start_type":9,"version_end":414,"version_end_type":368,"fixed_in":9},"lt3_1_51"]