Unsafe clone option gate bypass in GitPython via joined short options (CVE-2026-67324)

GitPython 3.1.50 fails to recognize joined short-option forms (e.g., `-u<value>`) when enforcing its unsafe-option gate during clone operations. An attacker who controls the `multi_options` argument passed to `Repo.clone_from()` can bypass the `allow_unsafe_options=False` protection and cause Git to execute an arbitrary helper command via the `--upload-pack`/`-u` option. This constitutes a bypass of an explicit security boundary, not an opted-in unsafe behavior. Affected versions: - = 3.1.50 We recommend updating to: >= 3.1.51. CVSS 9.3 · our assessment: act_now Reference: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v396-v7q4-x2qj Details: https://vuln.today/cve/CVE-2026-67324