https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 14:19:11 +0000 https://vulnerability.circl.lu/vuln/cve-2026-67324 <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython 3.1.50 fails to recognize joined short-option forms such as -u&lt;value&gt; (the short form of --upload-pack=&lt;value&gt;) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u&lt;helper&gt; to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.</p> <p><strong>Affected:</strong> gitpython-developers GitPython</p> <p>GitPython 3.1.50 fails to recognize joined short-option forms such as -u&lt;value&gt; (the short form of --upload-pack=&lt;value&gt;) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u&lt;helper&gt; to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.</p> https://vulnerability.circl.lu/vuln/cve-2026-67324