Baraksrour

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.58 **Description** Insufficient validation of options passed to the `git rm` and `git checkout` commands within the `IndexFile.remove()` and `Head.checkout()` functions allows for arbitrary file reading. An attacker can provide the `--pathspec-from-file` and `--pathspec-file-nul` parameters to access files readable by the process, with the contents returned in `GitCommandError.stderr`. **Recommendations** Update GitPython to version 3.1.58 or later.

**Name of the Vulnerable Software and Affected Versions** GitPython versions prior to 3.1.58 **Description** A remote code execution issue exists in the `Repo.init()` function. The software forwards unsafe git options without proper validation, allowing an attacker to provide a template parameter that points to a directory containing malicious git hooks. These hooks can then execute arbitrary code when git operations are performed on the initialized repository. **Recommendations** Update GitPython to version 3.1.58 or later.