CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.59 are vulnerable due to a failure to disable merge_includes when parsing .gitmodules files, which allows attackers to disclose sensitive local file content. By crafting a malicious .gitmodules file with specific include directives, an attacker can exploit this vulnerability to extract the first line of targeted files through error messages. Organizations using GitPython should prioritize updating to the latest version to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.
Related CVEs
Other vulnerabilities affecting the same vendor(s)