Description
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gitpython-developers | GitPython | 3.1.50 – < 3.1.51 | 3.1.51 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-git | 3.1.61-1 | — |
| Debian 13 | python-git | 3.1.44-1+deb13u1 | — |
| Debian 12 | python-git | 3.1.30-1+deb12u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | python-git | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 24.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 22.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 20.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 18.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 16.04 LTS | python-git | No fix yet | — |
| Ubuntu Pro 14.04 LTS | python-git | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform Developer 2 | automation-controller-cli | 4.6.32-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
| Red Hat Ansible Automation Platform Developer 2 | python-django +1 | 5.2.17-1.el10ap | RHSA-2026:59136 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-django | 5.2.17-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
| Red Hat Ansible Automation Platform 2 | automation-controller-cli +1 | 4.6.32-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-server | 2.5.20260824-1.el8ap | RHSA-2026:59135 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.13-1.el9ap | RHSA-2026:59136 |
| Red Hat Ansible Automation Platform 2 | python-django +1 | 5.2.17-1.el10ap | RHSA-2026:59136 |
| Red Hat Ansible Automation Platform 2 | python3.12-aiohttp | 3.14.3-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
| Red Hat Ansible Automation Platform 2 | python3.12-django | 5.2.17-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.59-1.el8ap | RHSA-2026:59136, RHSA-2026:59135 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | gitpython | >= 3.1.50, < 3.1.51 | 3.1.51 | GHSA-v396-v7q4-x2qj |
Advisories 2
- RHSA-2026:59135 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:59136 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
References
- GitHub Security Advisory (GHSA-v396-v7q4-x2qj) vendor-advisory
- VulnCheck Advisory: GitPython 3.1.50 Authentication Bypass via Joined Short Options third-party-advisory