Authentication Bypass in GitPython 3.1.50
CVE-2026-67324

9.3CRITICAL

Key Information:

Vendor

Gitpython-developers

Status
Gitpython
Vendor
CVE Published:
1 August 2026

What is CVE-2026-67324?

GitPython 3.1.50 contains a vulnerability where it fails to properly recognize combined short-option forms, such as -u, when enforcing its default gate for unsafe options. This flaw enables attackers to provide malicious clone options to the Repo.clone_from method, bypassing safety mechanisms. Consequently, attackers can manipulate Git's execution of specified helper commands during the cloning process, potentially leading to unauthorized command execution. The issue has been resolved in version 3.1.51.

Affected Version(s)

GitPython 3.1.50 < 3.1.51

GitPython 3.1.51

References

https://github.com/gitpython-developers/GitPython/securit...
vendor-advisory
https://www.vulncheck.com/advisories/gitpython-authentica...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Faze-up
.