GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to ove…
High CVSS 8.1
Summary
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f
- https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read
Timeline
- nvd_ingest NVD