CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.57 have an incomplete denylist in the unsafe_git_archive_options guard, allowing attackers to exploit the --add-file and --add-virtual-file options in Repo.archive(). This vulnerability enables unauthorized access to arbitrary files on the filesystem, posing a risk of data exposure. Developers and organizations using GitPython should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include them in the returned archive.
Related CVEs
Other vulnerabilities affecting the same vendor(s)