CVE-2026-67324

GitPython 3.1.50 Authentication Bypass via Joined Short Options

Published Aug 1, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.

Analysis

Technical impact

GitPython 3.1.50 does not correctly reject joined short-option forms such as -u<value> that map to --upload-pack=<value> when the default unsafe-option gate is enabled. This oversight allows an attacker to inject a command by passing -u<helper> to Repo.clone_from with allow_unsafe_options set to False. The injected helper is executed by Git during the clone, enabling arbitrary code execution. The vulnerability is a command injection flaw (CWE-78) and can compromise confidentiality, integrity, and availability of the system if the affected application processes malicious clone parameters.

Affected Systems

The flaw affects the GitPython library maintained by gitpython‑developers, specifically all releases up to and including version 3.1.50. The vendor identified a fix in release 3.1.51.

Risk and Exploitability

The CVSS score of 9.3 indicates high severity, but the EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploitation requires that the attacker can influence the clone options passed to Repo.clone_from, which is common in applications that accept user input for repository URLs or parameters. Once the attacker controls these options, the bypass can be triggered and the specified helper command will execute with the process’s privileges. The attack vector is therefore application‑level input injection via the clone API.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

gitpython-developers

GitPython

unaffected

Version	Status	Constraints
`3.1.50`	affected	< 3.1.51
`3.1.51`	unaffected	—

Configuration 1 [-]

cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*

No data.

Vendor Product Versions

Gitpython-developers

Gitpython

Version	Status	Scheme	Platform
`[3.1.50,3.1.51)`	affected	semver	—
`3.1.51`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade GitPython to version 3.1.51 or later to obtain the official fix.
If upgrading is temporarily infeasible, review any code that supplies options to Repo.clone_from and eliminate or tightly validate any short-option syntax such as -u<value> that could be supplied by untrusted sources.
Enter a brief period of remediation by running clone operations in a restricted execution environment, such as a container or chroot, to limit the impact of any potential helper command execution until a patch can be applied.

Generated by OpenCVE AI on August 2, 2026 at 03:00 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4872-1	python-git security update

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.454% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qj
https://nvd.nist.gov/vuln/detail/CVE-2026-67324
https://www.cve.org/CVERecord?id=CVE-2026-67324
https://www.vulncheck.com/advisories/gitpython-authentication-bypass-via-joined-short-options

History

Oct 8, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 14, 2026 5:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Gitpython Project Gitpython Project gitpython
CPEs		cpe:2.3:a:gitpython_project:gitpython::::::python::*
Vendors & Products		Gitpython Project Gitpython Project gitpython

Aug 4, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-67324 https://www.cve.org/CVERecord?id=CVE-2026-67324
Metrics	threat_severity `None`	threat_severity `Critical`

Aug 3, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 2, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Gitpython-developers Gitpython-developers gitpython
Vendors & Products		Gitpython-developers Gitpython-developers gitpython

Aug 1, 2026 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.
Title		GitPython 3.1.50 Authentication Bypass via Joined Short Options
Weaknesses		CWE-78
References		https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qj https://www.vulncheck.com/advisories/gitpython-authentication-bypass-via-joined-short-options
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`