A local file content disclosure vulnerability in GitPython allows unauthorized access to sensitive data due to improper handling of external file paths.

This vulnerability is caused by improper control of file names or paths, allowing an attacker to manipulate GitPython into accessing unintended local files. This vector does not require authentication as it is a local exploitation mechanism.

An attacker capable of triggering this vulnerability can read sensitive system files, configuration files, or credentials stored on the local disk. With a CVSS score of 8.4, this poses a significant risk to confidentiality and integrity, potentially leading to further system compromise or privilege escalation.

Immediate Action: Update the GitPython library to version 3.1.59 or later to address the path handling flaw.

Proactive Monitoring: Monitor file access logs for unexpected read operations on sensitive system files initiated by processes utilizing the GitPython library.

Compensating Controls: Run applications utilizing GitPython within isolated environments, such as containers or chroot jails, to limit the scope of file system access.

Public Exploit Available: No

Organizations using GitPython in environments that process external or untrusted git repositories must prioritize updating to version 3.1.59. Failure to patch may allow attackers to bypass standard file system restrictions and gain access to sensitive host data.