GitPython versions >=1.3.0 have three wrapper methods that omit critical unsafe protocol and option checks, leading to potential command injection and remote code execution (RCE). The ls_remote method forwards URLs without checking for unsafe protocols, allowing RCE if the victim's git transport policy permits the 'ext' transport. The merge_base and IndexFile.move methods forward caller arguments without checking for unsafe options, creating latent injection surfaces. These issues are verified on the main branch as of 2026-09-21 and remain unpatched in the latest release 3.1.62. The vulnerability is rated high severity with a CVSS score of 7.5.