GitPython Remote.pull() Refspec Bypasses The --upload-pack Unsafe-option Guard, Enabling Arbitrary Command Execution

Summary "Remote.pull" in GitPython forwards its positional "refspec" argument directly to the "git pull" child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the "refspec" for example a user-supplied branch or refspec...