GitPython before version 3.1.51 improperly neutralizes special elements in command arguments, specifically in the Repo.archive() and git.ls_remote() methods, allowing command injection via options such as --exec and --upload-pack. Furthermore, Repo.iter_commits() and Repo.blame() do not validate revision arguments that begin with a dash, which can cause Git to open and truncate arbitrary files. These vulnerabilities enable an attacker to execute arbitrary commands or manipulate files if the application using GitPython passes attacker-controlled inputs to these methods.

Successful exploitation can lead to arbitrary command execution on the host running GitPython, as well as potential file truncation or modification. This can compromise system integrity and confidentiality. The vulnerabilities require local access or an application that passes attacker-controlled arguments to the affected GitPython methods.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted or attacker-controlled input to the affected GitPython methods (Repo.archive(), git.ls_remote(), Repo.iter_commits(), and Repo.blame). Monitor vendor communications for updates and apply patches promptly once released.