GitPython releases prior to 3.2.0 contain a flaw that can lead to remote code execution. The vulnerability arises because the Git.ls_remote function forwards URLs through the ext:: transport without validating against unsafe protocols, and merge_base and IndexFile.move also allow unguarded option injection. By providing a specially crafted ext:: remote‑helper URL, an attacker can trigger arbitrary command execution within the environment where the Python process runs, compromising confidentiality, integrity, and availability of the system.

Vulnerable versions are all GitPython releases older than 3.2.0 distributed by the GitPython developers. No other specific releases or patches are identified.

The CVSS base score is 7.7, indicating substantial severity. No EPSS score could be retrieved and the vulnerability is not yet listed in CISA KEV. The attack can be carried out remotely when the affected application or service provides an attacker with the ability to invoke GitPython, for example by executing a Python script that calls ls_remote with a malicious ext:: URL. It could also be exploited locally by any user able to run arbitrary Python code that imports GitPython. Successful exploitation would give the attacker the same privileges as the Python process running GitPython.