CVE-2026-67324

A flaw was found in GitPython. A remote attacker can exploit a vulnerability where the software fails to properly recognize joined short-option forms e.g., -u when enforcing its default unsafe-option gate. This allows the attacker to bypass security checks and execute arbitrary commands during a...

Duplicate Advisory: GitPython unsafe clone option gate bypass through joined short options

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v396-v7q4-x2qj. This link is maintained to preserve external references. Original Description GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when...

CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options

GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...

CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options

GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...

CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options

GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...

CVE-2026-67324

GitPython 3.1.50 contains a vulnerability where joined short options like -u are not recognized when enforcing the default unsafe-option gate. This allows an attacker-controlled clone to supply -u and bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper during...

EUVD-2026-51808

GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...

PT-2026-67304

Name of the Vulnerable Software and Affected Versions GitPython version 3.1.50 Description An issue exists where the software fails to recognize joined short-option forms, such as -u, which is the short form of --upload-pack=, when enforcing its default unsafe-option gate. If an application passe...