[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-67325":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T17:35:29.592Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":40,"aliases":50,"duplicate_of":9,"upstream":61,"downstream":66,"duplicates":81,"related":82,"reserved_at":9,"published_at":87,"modified_at":88,"state":89,"summary":90,"references_raw":98,"kevs":164,"epss":165,"epss_history":168,"metrics":313,"affected":337},"CVE-2026-67325","GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names like upload_p instead of upload_pack, which git resolves to dangerous options and executes arbitrary commands.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-78","Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.","weakness","Stable","Base","High",[20,24,28,32,36],{"id":21,"name":22,"techniques":23},"CAPEC-108","Command Line Execution through SQL Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-15","Command Delimiters",[],{"id":29,"name":30,"techniques":31},"CAPEC-43","Exploiting Multiple Input Interpretation Layers",[],{"id":33,"name":34,"techniques":35},"CAPEC-6","Argument Injection",[],{"id":37,"name":38,"techniques":39},"CAPEC-88","OS Command Injection",[],[41],{"_key":42,"name":43,"source":44,"url":45,"maturity":46,"reliability_score":47,"verified":48,"type":9,"platforms":49,"requires_auth":9,"exploitdb":9,"metasploit":9},"GITHUB_GITPYTHON-DEVELOPERS_GITPYTHON","Gitpython","github","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wfm5-v35h-vwf4","poc",0.3,false,[],[51,52,53,54,55,56,57,58,59,60],"GHSA-2f96-g7mh-g2hx","UBUNTU-CVE-2026-67325","DEBIAN-CVE-2026-67325","CGA-28p5-cvm7-29rv","CGA-45m9-pxpv-wvw2","CGA-7wr7-v62g-5jv5","CGA-v96x-59m6-8q7f","PYSEC-2026-3836","CGA-2cf5-f2fv-vc3q","CGA-rj27-q3f3-5hxx",[62,64],{"_key":63},"GHSA-2F96-G7MH-G2HX",{"_key":65},"GHSA-6R2R-WW24-7H52",[67,69,71,73,75,77,79],{"_key":68},"OPENSUSE-SU-2026:11466-1",{"_key":70},"SUSE-SU-2026:4072-1",{"_key":72},"RHSA-2026:44416",{"_key":74},"RHSA-2026:45785",{"_key":76},"RHSA-2026:45940",{"_key":78},"RHSA-2026:59135",{"_key":80},"RHSA-2026:59136",[],[83,84,85],{"_key":68},{"_key":70},{"_key":86},"CGA-WPW7-54FG-VX4M","2026-08-01T12:22:16.817Z","2026-08-14T16:50:53.409Z","Analyzed",{"cisa_kev":48,"cisa_ransomware":48,"cisa_vendor":9,"epss_severity":91,"epss_score":92,"severity":93,"severity_score":94,"severity_version":95,"severity_source":96,"severity_vector":97,"severity_status":89},"low",0.01854,"high",8.8,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",[99,113,118,122,126,131,135,139,143,148,152,156,160],{"url":100,"sources":101,"tags":107},"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx",[96,102,103,104,105,106],"nvd","osv_pypi","osv_ubuntu","osv_wolfi","osv_chainguard",[108,109,110,111,112],"Vendor Advisory","WEB","REPORT","Exploit","Advisory",{"url":114,"sources":115,"tags":116},"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation",[96,102,104,103,105,106],[117,110,109,112],"Third Party Advisory",{"url":119,"sources":120,"tags":121},"https://github.com/gitpython-developers/GitPython/pull/2161",[103,105],[109],{"url":123,"sources":124,"tags":125},"https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285",[103,105],[109],{"url":127,"sources":128,"tags":129},"https://github.com/gitpython-developers/GitPython",[103,105],[130],"PACKAGE",{"url":132,"sources":133,"tags":134},"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51",[103,105],[109],{"url":136,"sources":137,"tags":138},"https://ubuntu.com/security/CVE-2026-67325",[104],[110],{"url":140,"sources":141,"tags":142},"https://www.cve.org/CVERecord?id=CVE-2026-67325",[104],[110],{"url":144,"sources":145,"tags":147},"https://security-tracker.debian.org/tracker/CVE-2026-67325",[146],"osv_debian",[112],{"url":149,"sources":150,"tags":151},"https://nvd.nist.gov/vuln/detail/CVE-2026-67325",[103,105,106],[112],{"url":153,"sources":154,"tags":155},"https://pypi.org/project/gitpython",[103],[130],{"url":157,"sources":158,"tags":159},"https://github.com/advisories/GHSA-2f96-g7mh-g2hx",[103],[112],{"url":161,"sources":162,"tags":163},"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67325.json",[105,106],[112],[],{"date":166,"score":92,"percentile":167},"2026-09-19",0.78215,[169,173,176,179,182,185,188,191,194,196,199,202,205,208,211,214,217,220,223,226,229,232,235,239,242,245,248,251,254,257,260,263,265,268,271,274,277,280,283,286,289,292,295,297,300,303,306,309,312],{"date":170,"score":171,"percentile":172},"2026-08-02",0.01483,0.7142,{"date":174,"score":171,"percentile":175},"2026-08-03",0.71427,{"date":177,"score":171,"percentile":178},"2026-08-04",0.71433,{"date":180,"score":171,"percentile":181},"2026-08-05",0.71455,{"date":183,"score":171,"percentile":184},"2026-08-06",0.71478,{"date":186,"score":171,"percentile":187},"2026-08-07",0.71507,{"date":189,"score":171,"percentile":190},"2026-08-08",0.71519,{"date":192,"score":171,"percentile":193},"2026-08-09",0.71514,{"date":195,"score":171,"percentile":190},"2026-08-10",{"date":197,"score":171,"percentile":198},"2026-08-11",0.71568,{"date":200,"score":171,"percentile":201},"2026-08-12",0.71628,{"date":203,"score":171,"percentile":204},"2026-08-13",0.71653,{"date":206,"score":171,"percentile":207},"2026-08-14",0.71695,{"date":209,"score":171,"percentile":210},"2026-08-15",0.7176,{"date":212,"score":171,"percentile":213},"2026-08-16",0.71773,{"date":215,"score":171,"percentile":216},"2026-08-17",0.71776,{"date":218,"score":171,"percentile":219},"2026-08-18",0.71795,{"date":221,"score":171,"percentile":222},"2026-08-19",0.71904,{"date":224,"score":171,"percentile":225},"2026-08-20",0.71944,{"date":227,"score":171,"percentile":228},"2026-08-21",0.71977,{"date":230,"score":171,"percentile":231},"2026-08-22",0.71988,{"date":233,"score":171,"percentile":234},"2026-08-23",0.71578,{"date":236,"score":237,"percentile":238},"2026-08-24",0.01449,0.71306,{"date":240,"score":237,"percentile":241},"2026-08-25",0.71327,{"date":243,"score":237,"percentile":244},"2026-08-26",0.7138,{"date":246,"score":237,"percentile":247},"2026-08-27",0.71409,{"date":249,"score":237,"percentile":250},"2026-08-28",0.71034,{"date":252,"score":237,"percentile":253},"2026-08-29",0.71057,{"date":255,"score":237,"percentile":256},"2026-08-30",0.71464,{"date":258,"score":237,"percentile":259},"2026-08-31",0.71476,{"date":261,"score":237,"percentile":262},"2026-09-01",0.71491,{"date":264,"score":237,"percentile":190},"2026-09-02",{"date":266,"score":237,"percentile":267},"2026-09-03",0.71535,{"date":269,"score":92,"percentile":270},"2026-09-04",0.77726,{"date":272,"score":92,"percentile":273},"2026-09-05",0.77444,{"date":275,"score":92,"percentile":276},"2026-09-06",0.77759,{"date":278,"score":92,"percentile":279},"2026-09-07",0.77765,{"date":281,"score":92,"percentile":282},"2026-09-08",0.77778,{"date":284,"score":92,"percentile":285},"2026-09-09",0.77888,{"date":287,"score":92,"percentile":288},"2026-09-10",0.77906,{"date":290,"score":92,"percentile":291},"2026-09-11",0.77923,{"date":293,"score":92,"percentile":294},"2026-09-12",0.77959,{"date":296,"score":92,"percentile":294},"2026-09-13",{"date":298,"score":92,"percentile":299},"2026-09-14",0.77971,{"date":301,"score":92,"percentile":302},"2026-09-15",0.78013,{"date":304,"score":92,"percentile":305},"2026-09-16",0.78092,{"date":307,"score":92,"percentile":308},"2026-09-17",0.78133,{"date":310,"score":92,"percentile":311},"2026-09-18",0.78194,{"date":166,"score":92,"percentile":167},[314,322,326,328,331,333,335],{"source":96,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":315,"cvss_v4_0":319},{"baseScore":94,"baseSeverity":316,"vectorString":97,"impactScore":317,"exploitabilityScore":318},"HIGH",9.8,7.2,{"baseScore":320,"baseSeverity":316,"vectorString":321,"impactScore":9,"exploitabilityScore":9},8.7,"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",{"source":102,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":323,"cvss_v4_0":324},{"baseScore":94,"baseSeverity":316,"vectorString":97,"impactScore":317,"exploitabilityScore":318},{"baseScore":320,"baseSeverity":316,"vectorString":325,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",{"source":103,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":327,"cvss_v4_0":9},{"baseScore":94,"baseSeverity":9,"vectorString":97,"impactScore":317,"exploitabilityScore":318},{"source":104,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":329,"cvss_v4_0":330},{"baseScore":94,"baseSeverity":9,"vectorString":97,"impactScore":317,"exploitabilityScore":318},{"baseScore":320,"baseSeverity":9,"vectorString":321,"impactScore":9,"exploitabilityScore":9},{"source":146,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":332},{"baseScore":320,"baseSeverity":9,"vectorString":325,"impactScore":9,"exploitabilityScore":9},{"source":105,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":334},{"baseScore":320,"baseSeverity":9,"vectorString":321,"impactScore":9,"exploitabilityScore":9},{"source":106,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":336},{"baseScore":320,"baseSeverity":9,"vectorString":321,"impactScore":9,"exploitabilityScore":9},[338,350,359,364,368,382,387,396,402],{"ecosystem":339,"name":340,"vendor":341,"product":340,"cpe_part":9,"purl_type":342,"purl_namespace":341,"purl_name":340,"source":9,"versions":343},"Chainguard","checkov","chainguard","apk",[344],{"version":345,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":348,"version_end_type":349,"fixed_in":9},"lt3_3_8_r1",true,"ecosystem","3.3.8-r1","excluding",{"ecosystem":339,"name":351,"vendor":341,"product":351,"cpe_part":9,"purl_type":342,"purl_namespace":341,"purl_name":351,"source":9,"versions":352},"mlflow",[353,356],{"version":354,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":355,"version_end_type":349,"fixed_in":9},"lt3_14_0_r2","3.14.0-r2",{"version":357,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":358,"version_end_type":349,"fixed_in":9},"lt3_16_0_r0","3.16.0-r0",{"ecosystem":360,"name":340,"vendor":361,"product":340,"cpe_part":9,"purl_type":342,"purl_namespace":361,"purl_name":340,"source":9,"versions":362},"Wolfi","wolfi",[363],{"version":345,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":348,"version_end_type":349,"fixed_in":9},{"ecosystem":360,"name":351,"vendor":361,"product":351,"cpe_part":9,"purl_type":342,"purl_namespace":361,"purl_name":351,"source":9,"versions":365},[366,367],{"version":354,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":355,"version_end_type":349,"fixed_in":9},{"version":357,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":358,"version_end_type":349,"fixed_in":9},{"ecosystem":369,"name":370,"vendor":371,"product":370,"cpe_part":9,"purl_type":372,"purl_namespace":371,"purl_name":370,"source":9,"versions":373},"Debian","python-git","debian","deb",[374,376,377,378,379],{"version":375,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",{"version":375,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":375,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":375,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":380,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":381,"version_end_type":349,"fixed_in":9},"lt3_1_61_1","3.1.61-1",{"ecosystem":383,"name":370,"vendor":384,"product":370,"cpe_part":9,"purl_type":372,"purl_namespace":384,"purl_name":370,"source":9,"versions":385},"Ubuntu","ubuntu",[386],{"version":375,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"ecosystem":9,"name":388,"vendor":389,"product":388,"cpe_part":390,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":391},"gitpython","gitpython_project","a",[392],{"version":393,"is_range":346,"range_type":394,"version_start":9,"version_start_type":9,"version_end":395,"version_end_type":349,"fixed_in":9},"lt3.1.51","cpe","3.1.51",{"ecosystem":9,"name":397,"vendor":398,"product":388,"cpe_part":390,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":399},"GitPython","gitpython-developers",[400],{"version":401,"is_range":346,"range_type":96,"version_start":9,"version_start_type":9,"version_end":395,"version_end_type":349,"fixed_in":9},"\u003C 3.1.51",{"ecosystem":403,"name":388,"vendor":403,"product":388,"cpe_part":9,"purl_type":404,"purl_namespace":9,"purl_name":388,"source":9,"versions":405},"PyPI","pypi",[406],{"version":407,"is_range":346,"range_type":347,"version_start":9,"version_start_type":9,"version_end":395,"version_end_type":349,"fixed_in":9},"lt3_1_51"]