GitPython versions before 3.1.51 contain multiple security vulnerabilities allowing command injection and arbitrary file manipulation. The library fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), enabling command injection via options like --exec and --upload-pack that can lead to arbitrary command execution. Additionally, Repo.iter_commits() and Repo.blame() do not validate leading-dash revision arguments, allowing a crafted revision such as --output=<path> to cause Git to open and truncate arbitrary files on the system. Exploitation requires that an application passes attacker-controlled arguments to these vulnerable methods. The vulnerability affects any application built on GitPython that processes untrusted user input and forwards it to these APIs. Users are advised to upgrade to GitPython 3.1.51 or later to remediate these issues.