CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.60 are vulnerable due to inadequate restriction of the --no-index option in the high-level diff API, enabling attackers to access arbitrary filesystem paths. This flaw allows for the exploitation of local files to extract sensitive information through a content-dependent Boolean oracle, potentially leading to the disclosure of secrets. Organizations using affected versions of GitPython should prioritize patching to mitigate the risk of data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses.