GitPython versions from 2.1.0 up to but not including 2.21.0 contain command injection vulnerabilities via unguarded Git options in methods such as Repo.archive(), git.ls_remote(), and others. These flaws allow an attacker to execute arbitrary commands or cause file truncation by injecting malicious options or revision strings. The issue arises because certain GitPython methods do not properly validate or restrict user-supplied arguments that are passed directly to Git commands. A fix is available in version 2.21.0.