The vulnerability in GitPython prior to version 3.1.58 involves improper validation of options passed to the git rm and git checkout commands within the IndexFile.remove() and Head.checkout() methods. Specifically, attackers can supply the --pathspec-from-file and --pathspec-file-nul parameters, which are intended to specify file paths from a file input. Due to lack of validation, this can be exploited to read arbitrary files accessible to the process. The full contents of these files are returned in the GitCommandError.stderr output, potentially exposing sensitive information. The CVSS 4.0 base score is 7.1, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required beyond local user, no user interaction, and high impact on confidentiality.

An attacker with local privileges can exploit this vulnerability to read arbitrary files accessible to the GitPython process. This can lead to unauthorized disclosure of sensitive information through error messages. There is no indication of privilege escalation, integrity, or availability impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running untrusted code or inputs that could exploit the git rm and git checkout commands in affected GitPython versions. Monitor vendor channels for updates and apply patches once released.