GitPython versions up to 3.1.57 contain a vulnerability in the config option name validation that allows injection of arbitrary git configuration directives. This occurs because the validator does not reject characters such as '=', '#', or whitespace in option names, enabling attackers to forge directives like core.sshCommand or core.hooksPath. Exploitation can lead to remote code execution on subsequent git operations. A patch is available to address this issue.