Arbitrary File Read in GitPython via TagReference.create()

Executive Summary

GitPython before 3.1.59 has an arbitrary file read vulnerability in TagReference.create(). Attackers can bypass safety checks by providing a reference parameter like --file=<path>, causing GitPython to read arbitrary files and include their contents in annotated tag messages.

Useful 0 Not Useful 0

Detection Guidance

Check GitPython version with pip show GitPython. If version is below 3.1.59, the system is vulnerable. Review code using TagReference.create() for positional reference parameters that might bypass safety checks.

Useful 0 Not Useful 0

Impact Analysis

An attacker could read sensitive files on your system if your application uses GitPython and passes user-controlled input to TagReference.create(). This could expose passwords, keys, or other confidential data processed by the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) by exposing personal or medical records. Compliance requires patching to prevent data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GitPython to version 3.1.59 or later immediately. Review and update any code passing positional reference arguments to TagReference.create() to ensure safety.

Useful 0 Not Useful 0