GitPython Unsafe-Option Gate Bypass via Joined Short-Option Argument (CVE-2026-67324)

Technical Analysis

The vulnerability stems from an incomplete denylist check in GitPython's clone_from() safety gate, which matches option strings like '--upload-pack' and '-u' as standalone tokens but fails to canonicalize or reject the combined short-option syntax '-u<helper>' used by Git's argument parser. An attacker who controls any part of the multi_options passed to clone_from can supply '-u/bin/sh -c "malicious_command"' (or similar) to have Git invoke an arbitrary helper binary during the clone handshake, resulting in full command execution on the host performing the clone. This is a classic input-validation/allowlist-bypass flaw (CWE-20/CWE-88) with a CVSS score of 9.8, indicating trivial exploitability and full system compromise potential with no privileges required beyond the ability to influence clone parameters. GitPython is a widely used dependency in automation tooling, CI/CD pipelines, and notably in AI agent frameworks and RAG pipelines that programmatically clone repositories (e.g., for code-analysis agents, autonomous coding assistants, or retrieval systems ingesting git-hosted content) — if such an agent accepts user- or LLM-generated clone parameters, this flaw could allow an attacker to achieve remote code execution on the agent's host, potentially exfiltrating API keys, credentials, or other secrets used by the agent.

Affected Systems

GitPython versions up to and including 3.1.50; any Python application or AI agent/automation framework that calls Repo.clone_from() with multi_options influenced by external/untrusted input, even when allow_unsafe_options=False is set. Fixed in GitPython 3.1.51.

Indicators of Compromise

• No specific malware hashes/IPs published for this CVE; indicators are contextual — look for anomalous Git clone invocations containing '-u' or '--upload-pack' joined arguments in application/CI logs, unexpected child processes spawned by git clone operations, and unauthorized outbound connections following repository clone events.

Remediation Steps

1. 1

   Upgrade GitPython

   Update GitPython to version 3.1.51 or later in all applications, CI/CD pipelines, and AI agent/RAG frameworks that use the library.

2. 2

   Audit clone_from() usage

   Review all code paths that call Repo.clone_from() or similar clone methods, especially where multi_options or clone arguments are derived from user input, LLM output, or external/untrusted sources.

3. 3

   Sanitize and allowlist clone options

   Implement strict allowlisting of permitted Git clone options rather than relying solely on library-level denylists; reject any options resembling '-u', '--upload-pack', or joined short-option forms.

4. 4

   Sandbox clone operations

   Run git clone operations for AI agents or automation in isolated, least-privilege containers/sandboxes with no access to sensitive credentials or internal network resources.

5. 5

   Monitor and log

   Enable logging of all git subprocess invocations and their arguments to detect exploitation attempts, and integrate alerts for anomalous helper-command execution during clones.