CVE-2026-67324

Name of the Vulnerable Software and Affected Versions GitPython version 3.1.50

Description An issue exists where the software fails to recognize joined short-option forms, such as -u<value>, which is the short form of --upload-pack=<value>, when enforcing its default unsafe-option gate. If an application passes attacker-influenced clone options into the Repo.clone from() function using the multi options parameter while allow unsafe options is set to False, an attacker can provide -u<helper> to bypass the security gate. This allows the execution of an arbitrary helper command during the clone process.

Recommendations Update GitPython to version 3.1.51.