{"action":"Upgrade gitpython to 3.1.51 or later.","affected":[{"fixed":"3.1.51","introduced":"3.1.50"}],"component":"gitpython","cve_ids":["CVE-2026-67324"],"ecosystem":"PyPI","epss":0.00644,"exploited":false,"fixed_versions":["3.1.51"],"ghsa_id":"GHSA-v396-v7q4-x2qj","id":"tcs_01M5KH8S43RP71FFCFBZVD6CB7","modified_at":"2026-09-11T13:45:02.949863536Z","published_at":"2026-08-01T13:17:02.770Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3947","https://www.vulncheck.com/advisories/gitpython-authentication-bypass-via-joined-short-options","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qj"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-3947","url":"https://osv.dev/vulnerability/PYSEC-2026-3947"}],"summary":"GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes atta"}