CVE-2026-73622
GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 13, 2026
- Updated
- Oct 8, 2026
- Reserved
- Aug 13, 2026
Description
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
GitPythongitpython-developers |
|
References
- GitHub Security Advisory (GHSA-94p4-4cq8-9g67)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.