GitPython 3.1.50 Vulnerability: Critical CVE Under Investigation
GitPython 3.1.50 is under investigation for a critical vulnerability (CVE-2026-67324) that may allow arbitrary command execution during Git clone operations. Users of GitPython versions prior to 3.1.51 are potentially affected.
What happened
GitPython 3.1.50 appears to fail to properly recognize joined short-option forms, such as -u<value>, when enforcing its default unsafe-option gate. An attacker could potentially supply -u<helper> to bypass this gate, causing Git to execute a specified helper command during a clone operation. This vulnerability is tracked as CVE-2026-67324 with a CVSS score of 9.8, indicating critical severity.
Multiple security advisories have been published detailing related issues in GitPython, including unguarded git option forwarding and incomplete denylists that could enable arbitrary file operations. These advisories can be found at [GHSA-3f7w-8rr8-f37f](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f), [GHSA-4gmw-gg2m-w46p](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p), and [GHSA-539m-9xh6-q6rr](https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr).
To assess your exposure, check if your projects or dependencies include GitPython versions prior to 3.1.51. It is recommended to upgrade to GitPython 3.1.51 or later as a precautionary measure. For more detailed information, consult the primary sources linked above.
How 0Day mitigates this
gitpython is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.