GitPython before 3.1.59 fails to disable merge_includes when parsing .gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious .gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message.

GitPython versions before 3.1.59 contain a vulnerability where the library fails to disable merge_includes when parsing .gitmodules files. This allows attackers to craft malicious .gitmodules files containing [include] directives that point to arbitrary local files. When repo.submodules is accessed, GitConfigParser raises a MissingSectionHeaderError that embeds the first line of the targeted file verbatim in the exception message, causing unintended local file content disclosure. The vulnerability can be exploited to expose sensitive files on the host system. A fix is available by upgrading to GitPython 3.1.59 or later. The issue has been documented in both the GitHub Security Advisory and VulnCheck advisories. It is classified as a high-severity information disclosure vulnerability affecting applications that use GitPython to process potentially untrusted repositories.