A vulnerability in ansible-core's ansible.builtin.git module allows argument injection via repository URLs starting with a dash. This flaw occurs because the module invokes git commands without a '--' separator before the repository URL, causing git to interpret dash-leading URLs as command-line options. An attacker controlling the repository URL can exploit this to execute arbitrary commands on the host running the module.