CVE-2026-73622CWE-200information-disclosure

CVE-2026-73622

High · published August 13, 2026

CVSS v3.1

7.5

EPSS

Percentile

42.9

In the wild

Unconfirmed

What it is

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00514 · 42.9th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2026-08-13T16:17Z

Affected products (1)

Product	Versions	Fixed in
gitpython_project/gitpython	< 3.1.55	3.1.55

References (4)

https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2 · [email protected]https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67 · [email protected]https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add · [email protected]https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

13 AUG 11:28Z
GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()
cvelistv5