Product
The GitPython library fails to validate the refspec positional argument in Remote.pull(), allowing attackers to inject shell commands via --upload-pack options when using SSH or local transports.