GitPython Argument Injection and File Read Flaws

Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config values: a dormant crafted value is silently rewritten into a live directive such as core.hooksPath whenever GitPython performs any unrelated config write. An attacker who can seed a malicious config value can thereby point hook execution at attacker-controlled code, gaining code execution the next time a hook-invoking git operation runs. Reported by VulnCheck (CWE-88) with a CVSS 4.0 base of 9.3; no public exploit or CISA KEV listing is identified at time of analysis.

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. The library's clone operations omit `--separate-git-dir` from the `unsafe_git_clone_options` blocklist, so any application that passes attacker-controlled values to `Repo.clone_from()` or `Repo.clone()` allows git to redirect repository metadata to an arbitrary filesystem path. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the path-traversal primitive combined with git-hook execution capability produces a realistic high-integrity-impact scenario in exposed applications.

GitPython before 3.1.59 discloses local file content through exception messages when parsing .gitmodules files that contain [include] directives, because the library fails to disable the merge_includes feature in GitConfigParser. An attacker who can introduce a malicious .gitmodules into a repository processed by a vulnerable GitPython instance can cause the first line of any locally readable file to appear verbatim in a MissingSectionHeaderError exception when repo.submodules is accessed. No active exploitation has been confirmed (absent from CISA KEV) and no public POC is referenced in available intelligence; a vendor-released patch exists in version 3.1.59.

Arbitrary file read in GitPython before 3.1.59 allows low-privileged remote attackers to exfiltrate sensitive files by supplying a crafted reference argument to TagReference.create(). The vulnerability arises because a positional reference parameter (e.g., '--file=/etc/passwd') bypasses the library's built-in unsafe option guard, causing git to interpret the value as a flag and return the targeted file's contents embedded in the annotated tag message. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 score of 7.1 with high confidentiality impact reflects genuine disclosure risk in any application that exposes this code path to user-controlled input.

Arbitrary file read in GitPython versions before 3.1.59 exposes sensitive filesystem content to low-privileged network attackers through an incomplete argument-injection guard. The unsafe_git_revision_options denylist in Repo.blame() omits the --contents and -S git options, allowing attackers to supply revision values such as --contents=/etc/passwd and receive the target file's contents embedded in the blame output. No public exploit has been identified at time of analysis, but the bypass is conceptually trivial - a crafted string is all that is required once access to the blame API is established.