GitPython versions up to 3.1.62 contain a vulnerability in the Head.checkout() method that allows an attacker to cause an arbitrary file read via a specially crafted branch name. The flaw arises because the positional branch name argument is not properly sanitized and is passed directly to the git checkout command without a separator, enabling injection of options such as --pathspec-from-file to read files like /etc/passwd. This issue is an incomplete fix of previous advisories and affects all published releases up to 3.1.62. A fix is available in version 3.2.0.