Description

GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T14:17:47.903Z",
  "pubdate": "2026-08-19T14:17:47.903Z",
  "executiveSummary": "An arbitrary file read vulnerability exists in GitPython versions prior to 3.1.58, specifically involving improper input validation within the IndexFile.remove() and Head.checkout() methods. This security flaw allows unauthenticated attackers to supply malicious parameters—namely --pathspec-from-file and --pathspec-file-nul—to underlying git rm and git checkout commands. Successful exploitation of this vulnerability results in the disclosure of arbitrary files accessible to the running process, with the complete contents of the targeted files returned directly within the GitCommandError.stderr exception. The risk implications are severe for environments where GitPython processes handle untrusted input, as sensitive system files, configuration data, or source code can be exfiltrated without requiring privileged access or network exposure beyond the application boundary. Remediation requires updating GitPython to version 3.1.58 or later to ensure proper sanitization and validation of options passed to internal git commands.",
  "technicalDetails": "The vulnerability resides in the input handling logic of GitPython, specifically within the IndexFile.remove() and Head.checkout() methods. The root cause is the failure to adequately validate and sanitize options passed to underlying command-line invocations of git rm and git checkout. Because user-supplied parameters are appended directly without stripping or restricting potentially dangerous command-line flags, an attacker can inject argument flags intended for the native git binary.\nSpecifically, an attacker can supply the --pathspec-from-file and --pathspec-file-nul parameters through the affected methods. The --pathspec-from-file option instructs git to read pathspecs from a specified file rather than from command-line arguments. By targeting a sensitive file accessible to the process running GitPython, the attacker forces the git subprocess to read the contents of that file.\nThe attack flow proceeds as follows: First, the attacker identifies an injection vector where untrusted data reaches IndexFile.remove() or Head.checkout(). Second, the attacker crafts a payload utilizing the --pathspec-from-file flag pointing to a target file path on the host system. Third, the GitPython library executes the underlying git command with the injected parameters. Fourth, upon execution, git encounters an error or processes the pathspec input in a manner that triggers a failure. Finally, the resulting error output includes the contents of the read file within the GitCommandError.stderr exception, which is then returned or exposed to the calling application or attacker.\nThe affected components are the IndexFile.remove() and Head.checkout() functions within GitPython versions before 3.1.58. The vulnerability does not require authentication or elevated privileges within the application itself, provided the attacker can influence the parameters passed to the vulnerable methods. The payload behavior leverages the native error-handling mechanism of GitPython to exfiltrate data via standard error streams. Post-exploitation impact includes the unauthorized disclosure of sensitive files accessible to the security context of the user running the GitPython process."
}