CVE-2026-67324: gitpython before 3.1.50 (exclusive); +1 more affected products

Affected technology

gitpython · before 3.1.50 (exclusive)
gitpython project

GitPython · 3.1.50 to before 3.1.51
gitpython-developers

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says when an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Vendor/CNA’s CVSS 4.0 assessment (base score 9.3/10) rates confidentiality, integrity and availability impact as high.