The vulnerability in GitPython arises because the unsafe_git_archive_options denylist consulted by Repo.archive() omits the --add-file and --add-virtual-file options. While the denylist blocks options that allow writing to arbitrary filesystem paths or executing commands, it does not block these two options that allow reading arbitrary files and injecting arbitrary content into the archive. This gap permits an attacker controlling the options passed to Repo.archive() to include arbitrary files from the filesystem in the generated archive, leading to arbitrary file read at the process privilege level. The issue was confirmed with a proof-of-concept that reads an out-of-tree file and extracts its contents from the archive. The recommended remediation is to either implement a strict allowlist of safe options or extend the denylist to include these options, consistent with the existing rationale for blocking options that take filesystem paths or URLs.

An attacker able to influence the options passed to Repo.archive() can read arbitrary files on the filesystem with the privileges of the GitPython process. This can lead to disclosure of sensitive information. The vulnerability does not enable code execution or denial of service. The impact is limited to confidentiality loss via arbitrary file read.

A patch is available for this vulnerability. The vendor or maintainers have extended the denylist to include --add-file and --add-virtual-file options or recommend implementing a strict allowlist of safe options for Repo.archive(). Users should upgrade GitPython to version 3.1.57 or later where this issue is fixed. If upgrading is not immediately possible, avoid passing user-controlled options to Repo.archive() or implement custom validation to block these unsafe options.