An attacker capable of influencing the arguments passed to these methods can trigger unauthorized filesystem operations. In IndexFile.checkout(), the lack of filtering for the --prefix option allows for arbitrary file overwriting, potentially resulting in remote code execution if the attacker can overwrite configuration files, SSH keys, or application scripts. In TagReference.create(), the lack of filtering for -F or --file options allows an attacker to read the contents of arbitrary files accessible to the application's service account, returning the data through the library's tag message interface. This issue persists in all versions of GitPython up to and including 3.1.56.

Attack Chain

1. An attacker identifies a target application using a vulnerable version of GitPython (3.1.56 or earlier).
2. The application exposes an interface where user-controlled input influences arguments passed to IndexFile.checkout() or TagReference.create().
3. The attacker crafts a payload containing dangerous git flags (e.g., --prefix for overwrite or --file for read).
4. The application processes the malicious input and passes the flags as keyword arguments to the vulnerable GitPython method.
5. GitPython internally invokes the git binary, appending the attacker's flags to the command line.
6. The git process executes with the privileges of the application's service account, applying the malicious flags to the filesystem.
7. Final impact: The attacker achieves unauthorized file read disclosure or arbitrary file overwrite, potentially leading to system compromise.

Impact

Successful exploitation allows attackers to overwrite critical system files or exfiltrate sensitive data. An attacker could overwrite files such as ~/.ssh/authorized_keys or post-checkout hooks to achieve persistence and code execution. The file read vulnerability enables the exfiltration of credentials, configuration files, and secrets. Because these operations occur at the privilege level of the application running the GitPython library, the potential damage is significant in both cloud-native environments and CI/CD pipelines.

Recommendation

• Upgrade GitPython to the latest version as soon as a patch is available.
• Implement a wrapper for all GitPython calls that use **kwargs to explicitly validate against a deny-list of dangerous git options like --prefix, --file, -F, -s, and -u.
• Enforce strict input validation on all user-supplied data that reaches GitPython methods to prevent the injection of arbitrary git flags.
• Monitor application logs for execution of git commands that include suspicious flags or path references originating from the application process.