The vulnerability exists in GitPython versions before 3.1.59, where the parser for .gitmodules does not disable merge_includes. An attacker can craft a malicious .gitmodules file with [include] directives pointing to arbitrary local files. When the application accesses repo.submodules, the GitConfigParser raises a MissingSectionHeaderError, and the exception message embeds the first line of the target file verbatim. This behavior allows the attacker to read sensitive files from the file system, resulting in information disclosure. The weakness is identified as CWE-73.

Affected vendors and products include the gitpython-developers’ GitPython library. All releases older than 3.1.59 are vulnerable. No additional version details are provided beyond the pre-3.1.59 range. Any user who employs the GitPython package and accesses submodule information should verify they are running a safe version.

The CVSS score of 8.6 indicates high severity, but the EPSS score is unavailable and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. The attack vector requires the attacker to supply a malicious .gitmodules file, which could be introduced remotely if the repository accepts arbitrary uploads or via a pull request, or locally if the attacker can write files to the repository. The exception message exposure shows the vulnerability can be exploited to reveal content without needing higher privileges than the process that runs GitPython. Consequently, the risk remains significant until patched.