GitPython 3.1.30 through any release prior to 3.2.0 has a command‑injection flaw in the Remote.pull() method. The unsafe‑option guard checks only keyword arguments, not the positional refspec. An attacker who controls the refspec can supply a payload such as --upload-pack=<command> that causes the application to execute arbitrary OS commands when performing a pull over local‑path or SSH transports. This flaw is identified as CWE‑88 and permits an attacker to run code with the same privileges as the Python process that performs the pull.

The affected product is GitPython, maintained by the GitPython developers. Versions ranging from 3.1.30 up to, but not including, 3.2.0 contain the vulnerability. Any environment – whether a local script, a web application, or a CI pipeline – that uses any of these releases and invokes Remote.pull() with an external repository is at risk. The defect does not affect earlier releases or GitPython 3.2.0 and later, which include a fixed safe‑option guard.

The CVSS score of 9.2 indicates critical severity. EPSS data are not available, and the issue is not listed in CISA KEV, yet the absence of a current EPSS does not reduce the risk if an attacker already has network connectivity to a Git repository the vulnerable host may pull from. The likely attack vector is an attacker‑controlled Git repository or a deceptive remote URL that the application pulls. Successful exploitation allows the attacker to execute arbitrary OS commands with the privileges of the process performing the pull, potentially leading to full system compromise.