CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.58 are vulnerable due to inadequate validation of options in the git rm and git checkout commands, allowing attackers to exploit the --pathspec-from-file and --pathspec-file-nul parameters. This could lead to unauthorized access to arbitrary files, exposing their contents through error messages. Organizations using affected versions of GitPython should prioritize updating to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.
Related CVEs
Other vulnerabilities affecting the same vendor(s)