CVE-2026-67324: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in gitpython-developers GitPython
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.
AI Analysis
Technical Summary
GitPython 3.1.50 fails to properly recognize joined short-option forms such as -u<value> (short for --upload-pack=<value>) when enforcing its default unsafe-option gate. This flaw allows an attacker who can influence clone options passed to Repo.clone_from with multi_options and allow_unsafe_options set to false to supply a crafted -u<helper> option. This bypasses the gate that blocks --upload-pack/-u options, causing Git to execute the specified helper command during the clone process. The vulnerability is resolved in GitPython version 3.1.51.
Potential Impact
An attacker able to supply clone options can execute arbitrary OS commands during the git clone operation, leading to potential full system compromise. The vulnerability has a CVSS 4.0 score of 9.3 (critical), indicating high impact with no required privileges or user interaction.
Mitigation Recommendations
Upgrade GitPython to version 3.1.51 or later where this vulnerability is fixed. Until then, avoid passing untrusted input to the multi_options parameter of Repo.clone_from with allow_unsafe_options set to false. Patch status is not explicitly stated but fixed version 3.1.51 is available, so upgrading is the recommended remediation.
CVE-2026-67324: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in gitpython-developers GitPython
Description
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.
CVSS v4.0
Score 9.3critical
Affected software
gitpython-developers
GitPython
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
GitPython 3.1.50 fails to properly recognize joined short-option forms such as -u<value> (short for --upload-pack=<value>) when enforcing its default unsafe-option gate. This flaw allows an attacker who can influence clone options passed to Repo.clone_from with multi_options and allow_unsafe_options set to false to supply a crafted -u<helper> option. This bypasses the gate that blocks --upload-pack/-u options, causing Git to execute the specified helper command during the clone process. The vulnerability is resolved in GitPython version 3.1.51.
Potential Impact
An attacker able to supply clone options can execute arbitrary OS commands during the git clone operation, leading to potential full system compromise. The vulnerability has a CVSS 4.0 score of 9.3 (critical), indicating high impact with no required privileges or user interaction.
Mitigation Recommendations
Upgrade GitPython to version 3.1.51 or later where this vulnerability is fixed. Until then, avoid passing untrusted input to the multi_options parameter of Repo.clone_from with allow_unsafe_options set to false. Patch status is not explicitly stated but fixed version 3.1.51 is available, so upgrading is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-29T13:07:21.184Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a6deb26bf32cb7a34c1fc11
Added to database: 08/01/2026, 12:48:38 UTC
Last enriched: 08/16/2026, 13:42:29 UTC
Last updated: 09/15/2026, 10:01:33 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.