GitPython versions prior to 3.2.0 have security weaknesses in three command wrapper methods—ls_remote, merge_base, and IndexFile.move—that omit checks for unsafe protocols and options. This omission allows potential command injection or remote code execution (RCE) when interacting with maliciously crafted git URLs or arguments, particularly if the underlying git transport policy permits unsafe protocols like 'ext'. The vulnerability is confirmed on the main branch as of 2026-09-21 and affects versions before 3.2.0. A fix is available in version 3.2.0.