GitPython versions >=2.1.0 and <3.0.3 contain vulnerabilities where three wrapper methods omit necessary unsafe protocol and option checks. The ls_remote method does not check for unsafe protocols, allowing remote code execution (RCE) if the victim's git transport policy permits the 'ext' protocol. The merge_base and IndexFile.move methods forward caller arguments without proper unsafe option checks, creating latent injection surfaces. These issues were verified on the main branch post the latest release. A fix is available in version 3.0.3.