CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options

Critical 9.3 Published 1 Aug 2026 Updated 8 Oct 2026

Attackers can bypass unsafe option checks in GitPython to execute arbitrary commands via joined short options during repository cloning.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-67324?

CVE-2026-67324 is a critical command injection vulnerability in gitpython-developers GitPython, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.

Weakness: CWE-78

Which versions are affected by CVE-2026-67324?

3 open source packages ship an affected version, including gitpython and GitPython. It affects 1 product.

Package	Affected	Fixed in
`gitpython` PyPI	From `3.1.50`	`3.1.51`
`gitpython` PyPI	From `3.1.50`	`3.1.51`
`GitPython` PyPI	From `3.1.50`	`3.1.51`

Products include Gitpython Project Gitpython.

How do I fix CVE-2026-67324?

Upgrade gitpython to 3.1.51 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-67324 being exploited?

There is no known exploitation of CVE-2026-67324 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-67324, ECHO-362f-e6d7-712b, ECHO-df65-2075-ea5e, GHSA-v396-v7q4-x2qj, MINI-3h2x-g8cg-2rqm, MINI-5w74-m64m-qrh2 and 5 more.