GitPython versions from 1.2.0.post0_3 up to but not including 1.2.0.post0_9 contain a command injection vulnerability. This occurs because unsafe Git options like --upload-pack and --receive-pack are blocked when passed as hyphenated kwargs, but the equivalent underscore-form kwargs bypass the safety checks and allow arbitrary command execution. This affects API methods such as Repo.clone_from(), Remote.fetch(), Remote.pull(), and Remote.push(). A fix is available in version 1.2.0.post0_9.