GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-opti…

GitPython version 3.1.50 contains a security flaw where its unsafe-option gate fails to recognize joined short-option forms such as -u<value>, which is the short form of --upload-pack=<value>. This allows an attacker who can influence clone options passed to Repo.clone_from() with allow_unsafe_options=False to bypass the safety gate by supplying -u<helper>. The bypass causes Git to execute an attacker-specified helper command during a clone operation, enabling potential remote code execution. The vulnerability is present when applications expose clone options to user-influenced input without proper sanitization. The flaw was fixed in GitPython version 3.1.51. This is a security bypass vulnerability affecting Python-based applications that use GitPython for Git repository operations. Developers using GitPython 3.1.50 should upgrade immediately to 3.1.51 to mitigate the risk.