StackRadar

CVE-2026-67323

High

Advisory

Published 21 Jul 2026In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.4
base score, highest
EPSS
0.010
62nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
48
of 17,781 indexed, latest versions
Container images
55
deployed by those charts
Fix available
1 of 1
affected package

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

Carried by container images the latest versions of 48 of 17,781 indexed charts deploy, on 55 images.

Affected packageAffected versionsFixed inImages
gitpythonpypi3.1.0, 3.1.7, 3.1.11, 3.1.17+14 more3.1.5155
OSV records
GHSA-956x-8gvw-wg5v
Also known as
PYSEC-2026-3839

Charts affected

48 by stars
ChartLatestAffected imagesRadar Score
ambassadordatawire6.9.51 of 2See more

ambassador datawire 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
gitpython@3.1.11
3.1.51

Open the chart page →

4,086
emissary-ingressdatawire7.1.8-ea1 of 1See more

emissary-ingress datawire 7.1.8-ea

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
datawire/emissary:2.0.2-ea9716efbdd24b
gitpython@3.1.11
3.1.51

Open the chart page →

4,918
edge-stackdatawire7.1.8-ea1 of 2See more

edge-stack datawire 7.1.8-ea

1 of the 2 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
datawire/aes:2.0.3-ea07f8fe4f4f8e
gitpython@3.1.11
3.1.51

Open the chart page →

5,173
stackstorm-hastackstormVerified publisher1.1.011 of 17See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
gitpython@3.1.37
3.1.51
stackstorm/st2api:3.86f56d239d280
gitpython@3.1.37
3.1.51
stackstorm/st2auth:3.833ecfda16608
gitpython@3.1.37
3.1.51
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
gitpython@3.1.37
3.1.51
stackstorm/st2notifier:3.8f190a6212195
gitpython@3.1.37
3.1.51
stackstorm/st2rulesengine:3.8259503496ff9
gitpython@3.1.37
3.1.51
stackstorm/st2scheduler:3.8b1de2055c362
gitpython@3.1.37
3.1.51
stackstorm/st2sensorcontainer:3.8b1a338f64773
gitpython@3.1.37
3.1.51
stackstorm/st2stream:3.81c8904a3bf67
gitpython@3.1.37
3.1.51
stackstorm/st2timersengine:3.81bf35bfaf00c
gitpython@3.1.37
3.1.51
stackstorm/st2workflowengine:3.819fdfffdbba8
gitpython@3.1.37
3.1.51

Open the chart page →

96,419
nautobotnautobotOfficialVerified publisher3.1.21 of 1See more

nautobot nautobot 3.1.2

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
networktocode/nautobot:3.0-py3.13ed484336b1ad
gitpython@3.1.46
3.1.51

Open the chart page →

4,332
daskhubdask2024.1.11 of 9See more

daskhub dask 2024.1.1

1 of the 9 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
pangeo/base-notebook:2024.01.155fbe688a4f80
gitpython@3.1.41
3.1.51

Open the chart page →

14,094
mlflowgetindataVerified publisher0.1.21 of 1See more

mlflow getindata 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
gcr.io/getindata-images-public/mlflow:latest25d6975951f1
gitpython@3.1.43
3.1.51

Open the chart page →

2,452
squestchristianhuthVerified publisher6.6.71 of 4See more

squest christianhuth 6.6.7

1 of the 4 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
gitpython@3.1.43
3.1.51

Open the chart page →

9,971
cosmotech-copilot-apicosmotech-apiVerified publisher0.1.11 of 1See more

cosmotech-copilot-api cosmotech-api 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
ghcr.io/cosmo-tech/cosmotech-copilot-api:latesta2be95de450c
gitpython@3.1.42
3.1.51

Open the chart page →

11,205
weblatedeliveryheroVerified publisher0.3.21 of 3See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
gitpython@3.1.7
3.1.51

Open the chart page →

7,984
deepstackgeek-cookbookVerified publisher1.5.21 of 2See more

deepstack geek-cookbook 1.5.2

1 of the 2 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
robmarkcole/deepstack-ui:latest410275726459
gitpython@3.1.18
3.1.51

Open the chart page →

5,305
helmuphelmupVerified publisher0.1.02 of 3See more

helmup helmup 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
sirrend/helmup-engine:0.1.13699e79e3d4e2
gitpython@3.1.40
3.1.51
sirrend/helmup-github-scraper:0.1.47ca688c7abf5
gitpython@3.1.40
3.1.51

Open the chart page →

16,514
mlflow-controllermlflow-deployment-controller0.1.82 of 2See more

mlflow-controller mlflow-deployment-controller 0.1.8

2 of the 2 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
gitpython@3.1.31
3.1.51
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
gitpython@3.1.31
3.1.51

Open the chart page →

8,957
mlflow-servermlflowserver0.1.91 of 3See more

mlflow-server mlflowserver 0.1.9

1 of the 3 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
buntha/mlflow:2.1.1154542cc3083
gitpython@3.1.29
3.1.51

Open the chart page →

5,804
ovh-snapshoterovh-snapshoterOfficialVerified publisher0.4.101 of 1See more

ovh-snapshoter ovh-snapshoter 0.4.10

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
ghcr.io/hoverkraft-tech/ovh-snapshoter/app:0.4.1010d271f08ab3
gitpython@3.1.42
3.1.51

Open the chart page →

761
streamlit-appstreamlit-appVerified publisher0.2.01 of 1See more

streamlit-app streamlit-app 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
sruthitanneru/pi-sample:ui-lateste565ea454ffd
gitpython@3.1.43
3.1.51

Open the chart page →

1,696
ansible-inspecansible-inspec0.2.171 of 2See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
ghcr.io/htunn/ansible-inspec:0.2.12cd25a5cc3f1b
gitpython@3.1.46
3.1.51

Open the chart page →

5,558
ambassadorazureorkestra6.7.91 of 2See more

ambassador azureorkestra 6.7.9

1 of the 2 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
datawire/aes:1.13.62beb65062c8b
gitpython@3.1.11
3.1.51

Open the chart page →

5,521
opencvecfi20170.1.21 of 7See more

opencve cfi2017 0.1.2

1 of the 7 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
ghcr.io/cfi2017/opencve-scheduler:3.0.08d943799621b
gitpython@3.1.44
3.1.51

Open the chart page →

15,371
cloudlaunchcloudve0.6.01 of 5See more

cloudlaunch cloudve 0.6.0

1 of the 5 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
gitpython@3.1.24
3.1.51

Open the chart page →

12,457
cloudlaunch-servercloudve0.2.01 of 5See more

cloudlaunch-server cloudve 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
gitpython@3.1.24
3.1.51

Open the chart page →

12,131
cloudlaunchservercloudve0.6.01 of 4See more

cloudlaunchserver cloudve 0.6.0

1 of the 4 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
gitpython@3.1.24
3.1.51

Open the chart page →

11,592
galaxykubemancloudve2.10.11 of 7See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
gitpython@3.1.27
3.1.51

Open the chart page →

16,069
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
gitpython@3.1.43
3.1.51

Open the chart page →

58,897
csgshipcsghubVerified publisher0.4.61 of 10See more

csgship csghub 0.4.6

1 of the 10 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
opencsghq/csgship-web:v0.4.0c36a5bac3cf0
gitpython@3.1.41
3.1.51

Open the chart page →

11,335
jupyterhubd4nVerified publisher3.3.71 of 7See more

jupyterhub d4n 3.3.7

1 of the 7 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
aristidetm/basic-notebook:3.6.5469dbc951224
gitpython@3.1.43
3.1.51

Open the chart page →

16,604
mlflowdeliveryheroVerified publisher1.0.101 of 1See more

mlflow deliveryhero 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
gitpython@3.1.7
3.1.51

Open the chart page →

4,422
skypilotgeek-cookbookVerified publisher0.0.11 of 3See more

skypilot geek-cookbook 0.0.1

1 of the 3 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
berkeleyskypilot/skypilot-nightly:latest8da2f3cda472
gitpython@3.1.45
3.1.51

Open the chart page →

8,923
mlflowhelm-charts-nr1.0.101 of 1See more

mlflow helm-charts-nr 1.0.10

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
larribas/mlflow:1.9.105ccb0b46bfb
gitpython@3.1.7
3.1.51

Open the chart page →

4,422
weblatehelm-charts-nr0.3.21 of 3See more

weblate helm-charts-nr 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
weblate/weblate:4.2.2-169c160d37a3c
gitpython@3.1.7
3.1.51

Open the chart page →

7,984
fastmcp-serverhelmforgeVerified publisher1.7.41 of 1See more

fastmcp-server helmforge 1.7.4

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.11.2fcb7017327d6
gitpython@3.1.44
3.1.51

Open the chart page →

3,281
mcp-serverhelmforgeVerified publisher1.0.01 of 1See more

mcp-server helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
helmforge/fastmcp-server:0.2.061f759a1421f
gitpython@3.1.44
3.1.51

Open the chart page →

3,430
ilum-streamlitilumVerified publisher0.1.01 of 1See more

ilum-streamlit ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
ilum/streamlit-example:1.0.0ce5dcdeb22ba
gitpython@3.1.45
3.1.51

Open the chart page →

2,736
erpnextimprowisedVerified publisher3.3.01 of 3See more

erpnext improwised 3.3.0

1 of the 3 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
improwised/erpnext-worker:v13.4.197280b55cbd4
gitpython@3.1.17
3.1.51

Open the chart page →

6,501
intelowlintelowl-helm6.6.1-01-06-20261 of 5See more

intelowl intelowl-helm 6.6.1-01-06-2026

1 of the 5 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
intelowlproject/intelowl:v6.6.10b22e547ea6b
gitpython@3.1.41
3.1.51

Open the chart page →

17,852
mlflowkelvins0.4.01 of 3See more

mlflow kelvins 0.4.0

1 of the 3 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
kelvinsp/mlflow:1.26.1cd33e6db2a59
gitpython@3.1.27
3.1.51

Open the chart page →

4,156
aperagkubeblocksVerified publisher0.0.0-nightly1 of 3See more

aperag kubeblocks 0.0.0-nightly

1 of the 3 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
apecloud/aperag:v0.0.0-nightly8ac9947a2c84
gitpython@3.1.44
3.1.51

Open the chart page →

8,405
kyso-nbdimekyso1.0.01 of 1See more

kyso-nbdime kyso 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
kyso/kyso-nbdime:latest4aa9d38ee81d
gitpython@3.1.29
3.1.51

Open the chart page →

2,765
legendlegend0.1.21 of 1See more

legend legend 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
ghcr.io/grofers/legend:0.1d6e901ad0ebd
gitpython@3.1.0
3.1.51

Open the chart page →

4,067
mlflow-servermlflow-server0.3.01 of 1See more

mlflow-server mlflow-server 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
gitpython@3.1.31
3.1.51

Open the chart page →

3,158
mlflowmondata-helm-chartsVerified publisher0.2.31 of 1See more

mlflow mondata-helm-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
mondata/mlflow:v2.3.0.s3.gc6f94c6caf8bf
gitpython@3.1.31
3.1.51

Open the chart page →

3,811
mlflowncsaVerified publisher1.2.11 of 4See more

mlflow ncsa 1.2.1

1 of the 4 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
evk02/mlflow:2.2.1ef6ff257ef35
gitpython@3.1.31
3.1.51

Open the chart page →

5,456
chatbot-ai-sampleopenshift0.1.61 of 4See more

chatbot-ai-sample openshift 0.1.6

1 of the 4 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
gitpython@3.1.43
3.1.51

Open the chart page →

18,922
qubivaqubiva0.3.21 of 3See more

qubiva qubiva 0.3.2

1 of the 3 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
gitpython@3.1.50
3.1.51

Open the chart page →

4,272
checkmkrtomik-helm-chartsVerified publisher0.1.01 of 1See more

checkmk rtomik-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
checkmk/check-mk-community:2.5.0p6c11b422210c4
gitpython@3.1.50
3.1.51

Open the chart page →

7,436
runwhen-localrunwhen-contribVerified publisher0.6.171 of 3See more

runwhen-local runwhen-contrib 0.6.17

1 of the 3 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
gitpython@3.1.50
3.1.51

Open the chart page →

3,707
weblateslamdev0.0.111 of 2See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
weblate/weblate:3.11.3-182848df56ecd
gitpython@3.1.0
3.1.51

Open the chart page →

8,694
ambassadorwenerme6.9.51 of 2See more

ambassador wenerme 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-67323.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
gitpython@3.1.11
3.1.51

Open the chart page →

4,086

Container images carrying it

55 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/mlops-for-all/mlflow-tracking-server:3.8-1.30.1-v1.0.0d30e631684c3
gitpython@3.1.31
3.1.51
1
ghcr.io/qubiva/qubiva:v0.3.2cdf1e3329bfe
gitpython@3.1.50
3.1.51
1
ghcr.io/runwhen-contrib/runwhen-local:0.12.0533ce58c6e02
gitpython@3.1.50
3.1.51
1
quay.io/hewlettpackardenterprise/squest:2.8.465694109877e
gitpython@3.1.43
3.1.51
1
quay.io/redhat-ai-dev/chatbot:latest59fe607dfdf2
gitpython@3.1.43
3.1.51
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.