Description

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T12:17:27.057Z",
  "pubdate": "2026-08-13T12:17:27.057Z",
  "executiveSummary": "GitPython before 3.1.57 suffers from an insecure option forwarding vulnerability arising from improper input sanitization in specific API methods. The vulnerability impacts the GitPython library, specifically within the IndexFile.checkout() and TagReference.create() functions, where keyword arguments (kwargs) are improperly handled and passed directly as command-line options to underlying Git processes.\nThis security flaw enables malicious actors to leverage arbitrary Git option forwarding to compromise the host system. The primary risk implications include arbitrary file overwrite and unauthorized arbitrary file read capabilities. By supplying specially crafted arguments such as --prefix or -F, an attacker can manipulate operational parameters of the underlying Git execution flow.\nThe attack capability requires the ability to influence parameters passed to the vulnerable GitPython functions via application input channels. The exploitation does not inherently require complex authentication or elevated privileges within the context of the vulnerable application, relying instead on how the host application exposes the affected functions to untrusted data.\nSuccessful exploitation allows attackers to overwrite critical system files with repository content or exfiltrate sensitive local file contents in-band, leading to potential data exposure, system integrity compromise, and further application-level escalation.",
  "technicalDetails": "The root cause of the vulnerability resides in the lack of adequate input validation and option sanitization within GitPython before version 3.1.57. Specifically, the vulnerable components are the IndexFile.checkout() and TagReference.create() methods, which accept arbitrary keyword arguments (kwargs) and forward them directly to the underlying git command-line interface without restricting dangerous flags or options.\nThe exploitation method relies on command-line option injection via API parameter misuse. Because the library fails to restrict or validate user-supplied keyword arguments, callers can inject command-line flags intended for the git executable that alter its expected behavior. Attackers target this behavior by passing specific flags through the exposed kwargs interface.\nThe attack flow proceeds as follows: First, an unvalidated attack vector reaches the vulnerable application logic that invokes either IndexFile.checkout() or TagReference.create(). Second, the attacker supplies malicious keyword arguments designed to interface with underlying git flags. Third, GitPython constructs the subprocess command incorporating the unsanitized options. Fourth, the underlying git binary executes with the injected flags, such as --prefix or -F.\nPayload behavior involves exploiting specific native capabilities of the git binary. By passing the --prefix option, an attacker can force checkout operations to write repository contents to arbitrary filesystem locations, effectively overwriting critical files with repository data. Alternatively, utilizing the -F option allows the reading of arbitrary local files, which are subsequently returned in-band through the execution output, facilitating unauthorized information disclosure.\nThe affected versions include all releases of GitPython prior to 3.1.57. Network exposure and privilege requirements depend entirely on how the host application exposes the vulnerable library functions to external users or untrusted data sources. No specific authentication or privilege level is mandated by GitPython itself to trigger the flaw, as the vulnerability is inherent to the insecure API design of the affected functions."
}