GitPython's IndexFile.checkout() and TagReference.create() methods forward caller-controlled keyword arguments directly to underlying git commands without applying the intended safety checks via Git.check_unsafe_options(). This allows exploitation of git options that accept filesystem paths. Specifically, IndexFile.checkout() forwards **kwargs to 'git checkout-index', enabling an attacker to specify the --prefix option to write repository-controlled files to arbitrary locations on the filesystem, potentially overwriting critical files. TagReference.create() forwards **kwargs to 'git tag', allowing the use of the -F/--file option to read arbitrary files on the filesystem, with contents returned in-band via the tag message. These vulnerabilities are present in GitPython versions before 3.1.57 and have a CVSS 3.1 score of 8.1 (High). The issues are similar in nature to previously fixed defects in other GitPython methods but remain unpatched in these two call sites at the time of reporting. A fix is available.

An attacker with the ability to influence repository content or invoke these GitPython APIs can overwrite arbitrary files on the filesystem with repository-controlled data, potentially leading to code execution under the service account. This is due to the unchecked --prefix option in 'git checkout-index'. Additionally, the attacker can read arbitrary files on the filesystem via the unchecked -F/--file option in 'git tag', exposing sensitive information at the process privilege level. These impacts are significant given the potential for privilege escalation and data disclosure.

A patch is available for GitPython that addresses these vulnerabilities by adding proper validation and guarding of unsafe git options in the affected methods. Users should upgrade to version 3.1.57 or later. Until patched, avoid passing untrusted input through the affected methods' **kwargs parameters or use alternative safe APIs. Review and restrict usage of IndexFile.checkout() and TagReference.create() to trusted contexts only.