A critical argument-injection flaw in GitPython 3.1.50 lets attacker-influenced clone options slip past the library's unsafe-option gate and execute arbitrary commands during a clone.
What Is It
CVE-2026-67324 affects GitPython 3.1.50. The library's default unsafe-option gate is supposed to block dangerous Git flags such as --upload-pack and its short form -u, but it fails to recognize joined short-option forms; that is, -u<value> written as a single argument rather than as -u <value>.
The classification of the flaw is not consistent across sources. The CVE and advisory data label it OS command injection (CWE-78) reached through argument injection, while VulnCheck characterizes the same defect as an authentication bypass via joined short options. The underlying mechanism described is the same in both cases, the gate's failure to normalize joined short options, but the weakness category should be treated as unsettled until analysis completes.
When an application feeds attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to slip past the gate. Git then executes the specified helper command during the clone.
Why It Matters
The published severity data is provisional and internally inconsistent, so treat the numbers as preliminary. The record carries a base score of 9.8 (CRITICAL) labeled as CVSS 3.1, but the accompanying vector string is CVSS:4.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, a 4.0 version prefix attached to metrics written in 3.1 syntax (S:U is a 3.1 scope metric with no CVSS 4.0 equivalent). A separate CVSS 4.0 assessment rates the flaw 9.3 (CRITICAL). Because NVD lists the entry as "Received" with analysis still pending, none of these scores should be treated as final; they may be revised, reconciled, or re-versioned once NVD completes its review.
Whichever score survives analysis, the underlying metrics point the same direction: network attack vector, low complexity, no privileges, and no user interaction required, with high impact to confidentiality, integrity, and availability.
The core problem is that the affected code path is the safe one. allow_unsafe_options=False is the default posture developers rely on when handling untrusted clone parameters, so applications that did the defensive thing are exactly the ones exposed. Any service that accepts user-supplied clone options, CI/CD runners, repository mirroring services, package tooling, is a candidate for remote code execution.
What's Vulnerable
- Vendor: gitpython-developers
- Product: GitPython (
pkg:pypi/GitPython) - Affected: version 3.1.50 (>= 3.1.50, < 3.1.51)
- Unaffected: 3.1.51 and later
The vulnerable pattern requires the application to pass externally influenced values into multi_options on Repo.clone_from().
Patch Status
Fixed in GitPython 3.1.51. Upgrade to 3.1.51 or later. Where an immediate upgrade is not possible, do not pass untrusted or attacker-influenced values into multi_options, and validate clone options against an allowlist rather than relying on the library gate.
No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation or federal remediation deadline on record at this time. NVD status is "Received" (published 2026-08-01), meaning the affected-version ranges, weakness classification, and severity metrics above come from the CNA and advisory data rather than from completed NVD analysis, and are subject to change.