GitPython versions prior to 3.1.58 contain a vulnerability in the IndexFile.remove() and Head.checkout() methods. These methods forward arbitrary keyword arguments into git rm and git checkout commands without proper validation. When used with the --pathspec-from-file and --pathspec-file-nul options, this allows an attacker to cause Git to treat the entire contents of a chosen file as a pathspec, leading to the file's contents being leaked in error messages. This results in an arbitrary file read vulnerability disclosed through GitCommandError.stderr.