GitPython contains a command injection vulnerability due to incomplete blocking of unsafe git options. The fix for CVE-2026-42215 implemented a blocklist for dangerous git options but did not account for git's acceptance of unambiguous long-option prefix abbreviations. This allows attackers to bypass the blocklist by using abbreviated option keys, leading to command injection when GitPython emits these options to git commands. The vulnerability affects all versions carrying the 3.1.47 blocklist fix through versions before 3.1.51. Exploitation requires a host application that passes attacker-controlled keyword argument keys to GitPython's clone, fetch, pull, or push methods. The severity is high, reflecting potential remote code execution impact.