CVE-2026-67324

Gitpython command injection

9.8 CRITICALPublic exploitEPSS 0.64%

Published1 Aug 2026

Description

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Gitpython< 3.1.50

Remediation

Fixed in

Gitpython≥ 3.1.50

Patch & vendor advisories

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qj

References

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qjExploitVendor Advisory
https://www.vulncheck.com/advisories/gitpython-authentication-bypass-via-joined-short-optionsThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-67324 being actively exploited?

CVE-2026-67324 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.64%.

How severe is CVE-2026-67324?

CVE-2026-67324 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 0.64% probability of exploitation.

Which products are affected by CVE-2026-67324?

Affected products include Gitpython.

How do I fix CVE-2026-67324?

Upgrade affected software to a fixed version, for example Gitpython 3.1.50 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-67324 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.