The vulnerability arises because the _option_candidates function only derives value-token candidates when split_single_char_options is True. When set to False, the guard's candidate list omits the smuggled option, allowing the transform_kwarg function to emit a joined token that git interprets as a --upload-pack command, enabling arbitrary command execution. This bypasses the existing unsafe option guard implemented in commit e8d0fbf7, which only checks candidates when split_single_char_options is True. The flaw affects all guarded GitPython methods that forward kwargs and use split_single_char_options=False with a single-character key. The vulnerability is present in GitPython versions up to and including 3.1.57.

An attacker who can control kwargs passed to GitPython methods such as clone, fetch, pull, push, ls_remote, iter_commits, blame, or archive and set split_single_char_options=False with a crafted single-character option can achieve arbitrary OS command execution on the host running the GitPython process. This occurs despite the default allow_unsafe_options=False setting, as the unsafe option guard is bypassed due to incomplete candidate detection. The impact includes full confidentiality, integrity, and availability compromise of the host system via command execution.

A patch is available that corrects the _option_candidates function to emit value-derived candidates regardless of the split_single_char_options flag, or alternatively runs the unsafe option guard over the fully transformed argv tokens rather than the reconstructed candidate list. Users should upgrade GitPython to version 3.1.58 or later where this issue is fixed. Until patched, avoid passing split_single_char_options=False with user-controlled single-character kwargs to guarded GitPython methods.