GitPython versions from 0.7.0 up to but not including 2.4.5_1 contain command injection vulnerabilities via unguarded Git options in methods such as Repo.archive(), git.ls_remote(), and arbitrary file operations in Repo.iter_commits and Repo.blame. These vulnerabilities allow an attacker to execute arbitrary commands or cause file truncation by passing crafted arguments that bypass internal safety checks. The issue arises because certain keyword arguments are transformed into Git command options without proper validation, enabling injection of malicious commands. The vulnerabilities are fixed in version 2.4.5_1.