GitPython prior to version 3.1.59 fails to safely handle multi-line git-config values when writing configuration files. Specifically, it improperly neutralizes argument delimiters, causing dormant quoted values to be transformed into active git directives. Attackers can craft malicious config files embedding newlines that become live directives after any unrelated config write operation by GitPython. This enables arbitrary code execution through the invocation of git hooks, representing an argument injection vulnerability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the system running GitPython by injecting malicious git directives through crafted configuration files. This can lead to full system compromise without requiring user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted git configuration files with GitPython and monitor for updates from the gitpython-developers project regarding patches or mitigations.