Loading vulnerability…
GitPython Joined Short-Option Gate Bypass Leading to Arbitrary Command Execution
CVE-2026-67324 is an unsafe-option validation bypass in GitPython 3.1.50. The validation applied to Repo.clone_from fails to recognize joined short-option forms such as -u<value>, equivalent to --upload-pack=<value>. When an application forwards attacker-influenced options through multi_options, an attacker can bypass restrictions on the upload-pack option even with allow_unsafe_options=False. Git can consequently execute an attacker-specified helper command during cloning. GitPython 3.1.51 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary command execution with the privileges of the application performing the clone. This can compromise the confidentiality, integrity, and availability of data and resources accessible to that application.
If you can’t patch tonight, do this now.
Until upgraded, prevent attacker-controlled values from reaching the multi_options parameter of Repo.clone_from. If configurable clone options are necessary, enforce a strict allowlist and reject --upload-pack, -u, and joined forms such as -u<value>. Setting allow_unsafe_options=False alone does not mitigate this vulnerability.
Patch, then assume compromise.
Upgrade GitPython 3.1.50 to version 3.1.51 or later. For affected Red Hat Ansible Automation Platform deployments, apply the relevant updates under RHSA-2026:59135 or RHSA-2026:59136, which include updated python3.12-gitpython packages at version 3.1.59. GitPython 3.1.50 is vulnerable and must not be treated as a fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.