CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.57 are vulnerable due to improper handling of git option forwarding in the IndexFile.checkout() and TagReference.create() methods. This flaw allows attackers to exploit unsafe options, potentially overwriting arbitrary files with repository content or reading sensitive files through in-band responses. Organizations using GitPython should prioritize patching to mitigate the risk of unauthorized file manipulation and data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.