GitPython versions from 3.1.30 up to but not including 3.1.47 contain a command injection vulnerability via unsafe handling of Git options passed as Python kwargs. The library blocks dangerous Git options like --upload-pack and --receive-pack when passed as hyphenated strings, but the equivalent underscore-form kwargs (e.g., upload_pack) bypass this check and are converted into unsafe Git command-line flags. This allows attacker-controlled input to execute arbitrary commands during repository clone, fetch, pull, or push operations. A fix is available in version 3.1.47.