GitPython versions from 2.1.0 up to but not including 2.9.0 contain a command injection vulnerability via unsafe handling of Git options passed as Python kwargs. Specifically, the underscore-form kwargs such as upload_pack and receive_pack bypass the safety checks designed to block dangerous Git options, leading to arbitrary command execution when attacker-controlled input is passed to Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(). This vulnerability is fixed in version 2.9.0.