CyberRota Analysis
AI-GeneratedGitPython versions prior to 3.1.59 are vulnerable to an arbitrary file read issue in the TagReference.create() function, allowing attackers to exploit a bypass in the option guard by supplying a crafted reference parameter. This vulnerability can lead to unauthorized access to sensitive file contents, which are then returned in the annotated tag message. Organizations using GitPython should prioritize updating to the latest version to mitigate potential data exposure risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arbitrary files, with contents returned in the annotated tag message.