Is CVE-2026-67324 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67324 being exploited in the wild.

How severe is CVE-2026-67324?

Critical severity, with a CVSS score of 9.8, published 1 August 2026.

Which products and versions are affected?

gitpython (PyPI) ECOSYSTEM:introduced=3.1.50,fixed=3.1.51.

Is there a fix for CVE-2026-67324?

Yes. gitpython (PyPI): upgrade to 3.1.51 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67324 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-67324?

Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67324: GitPython unsafe option gate bypass through joined short options

CVE-2026-67324 · Severity: critical · CVSS 9.8 · Published 2026-08-01

GitPython is a Python library used by applications to interact with Git repositories, including cloning and pulling code. Version 3.1.50 has a flaw in its security controls that is meant to block dangerous Git clone options—an attacker who controls clone parameters can bypass this protection by using an alternate syntax for the --upload-pack option, allowing arbitrary command execution during repository cloning.

Technologies: Gitpython Project Gitpython, gitpython (PyPI). Vendors: Gitpython Project, PyPI.

Quick answers

Is CVE-2026-67324 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67324 being exploited in the wild.
How severe is CVE-2026-67324?: Critical severity, with a CVSS score of 9.8, published 1 August 2026.
Which products and versions are affected?: gitpython (PyPI) ECOSYSTEM:introduced=3.1.50,fixed=3.1.51.
Is there a fix for CVE-2026-67324?: Yes. gitpython (PyPI): upgrade to 3.1.51 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67324 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-67324?: Check whether you run Gitpython Project Gitpython or gitpython (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gitpython (PyPI): upgrade to 3.1.51 or later
```
pip install "gitpython>=3.1.51"
```

Technical details

GitPython 3.1.50 implements a gate to block unsafe Git clone options (--upload-pack, -u, --config, -c) when allow_unsafe_options=False. The vulnerability is an OS command injection (CWE-78) in the option validation logic: the _canonicalize_option_name() function fails to recognize joined short-option forms such as -u<value> (Git's short form of --upload-pack=<value>). When Repo.clone_from(..., multi_options=["-u<helper>"], allow_unsafe_options=False) is called, the validator incorrectly canonicalizes -u<value> to "u<value>" instead of "u", causing it to bypass the blocked option check. Git then accepts the joined short option and executes the helper command. Attack vector is network (attacker controls multi_options passed to clone_from). The fix is available in GitPython 3.1.51.

Affected products

GitPython GitPython 3.1.50

Identifiers

CVE-2026-67324
GHSA-v396-v7q4-x2qj
PYSEC-2026-3947

Timeline

2026-07-12: disclosed: GitHub security advisory GHSA-v396-v7q4-x2qj published
2026-08-01: advisory: CVE-2026-67324 published
2026-08-01: patched: Fix released in GitPython 3.1.51

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.