CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.57 have an incomplete denylist in the unsafe_git_archive_options guard, allowing attackers to exploit the --add-file and --add-virtual-file options in Repo.archive(). This vulnerability enables unauthorized access to arbitrary files on the filesystem, posing a risk of data exposure. Developers and organizations using GitPython should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.