CVE-2026-67324: GitPython 3.1.50 Authentication Bypass via Joined Short Options
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom(..., multioptions=..., allowunsafeoptions=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.51 - Configuration
Ensure allow_unsafe_options is set to False when using Repo.clone_from with attacker-influenced clone options (multi_options), so joined short options like -u<value> cannot bypass the default unsafe-option gate.
GitPython Repo.clone_from(..., allow_unsafe_options=False) allow_unsafe_options = False
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67324?
CVE-2026-67324 has a critical severity score of 9.8.
How does CVE-2026-67324 affect GitPython?
CVE-2026-67324 allows for an authentication bypass in GitPython 3.1.50 via joined short-option forms.
How can I fix CVE-2026-67324?
To address CVE-2026-67324, upgrade to the latest version of GitPython that includes security patches.
What is the risk associated with CVE-2026-67324?
The risk associated with CVE-2026-67324 is categorized as high due to the potential for unauthorized access.
Is CVE-2026-67324 easy to exploit?
CVE-2026-67324 can be exploited with relatively low effort, given that it allows attacker-controlled input.