GitPython versions up to 3.1.57 contain a vulnerability where the unsafe git option guard can be bypassed by using the split_single_char_options=False flag combined with a single-character keyword argument. This allows an attacker to smuggle a short option token that leads to arbitrary OS command execution via the git --upload-pack option. The vulnerability affects all guarded methods that forward kwargs and occurs despite the default allow_unsafe_options=False setting. A patch is available to fix this issue.