GitPython versions before 3.1.58 have an arbitrary file overwrite flaw in methods that construct git read-tree commands. The flaw allows an attacker to inject the '--index-output' option through a caller‑supplied treeish string, causing the underlying git process to write a valid git-index blob to any file path the attacker can write to. This can erase existing file contents and, if the overwritten file is executable or used by a service, can lead to unauthorized execution or denial of service. The weakness corresponds to CWE-88, representing how unvalidated input can lead to unintended file system writes.

The vulnerability affects the GitPython project, specifically any release before 3.1.58. Systems that employ GitPython in code that receives user‑supplied treeish values—such as build tools, deployment scripts, or other automation—are impacted. The risk applies to all operating systems where the affected GitPython version is installed.

With a CVSS score of 7.2 the flaw is considered high severity, although no EPSS value is available. The vulnerability is not yet listed in CISA's KEV catalog. Attackers can exploit the flaw locally by triggering GitPython operations with a crafted treeish string. The exploitation requires write access to target file paths, so the threat is most relevant when the executing environment has elevated permissions or when untrusted input can reach the GitPython API. Monitoring for unexpected file overwrites and applying the official upgrade are essential to mitigate this risk.