CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2	Patch
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67	Exploit Vendor Advisory
https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add	Third Party Advisory
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*

History

23 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) GitPython anterior a la versión 3.1.55 no logra deshabilitar la expansión de variables de entorno en el manejo de URL de Remote.create() y Submodule.add(), permitiendo a los atacantes exfiltrar secretos al proporcionar URL que contienen referencias a variables. Los atacantes pueden crear URL con tokens de variables de entorno que se expanden en .git/config y .gitmodules, y luego se transmiten a hosts controlados por el atacante durante operaciones de fetch o pull.

Information

Published : 2026-08-13 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73622

Mitre link : CVE-2026-73622

CVE.ORG link : CVE-2026-73622

JSON object : View

Products Affected

gitpython_project

gitpython

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-73622", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73622", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T12:56:43.368192Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "gitpython-developers", "product": "GitPython", "versions": [{"status": "affected", "version": "0", "lessThan": "3.1.55", "versionType": "semver"}, {"status": "unaffected", "version": "3.1.55", "versionType": "semver"}], "packageURL": "pkg:pypi/GitPython", "defaultStatus": "unaffected"}]}], "published": "2026-08-13T12:17:27.337", "references": [{"url": "https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67", "tags": ["Exploit", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations."}, {"lang": "es", "value": "GitPython anterior a la versi\u00f3n 3.1.55 no logra deshabilitar la expansi\u00f3n de variables de entorno en el manejo de URL de Remote.create() y Submodule.add(), permitiendo a los atacantes exfiltrar secretos al proporcionar URL que contienen referencias a variables. Los atacantes pueden crear URL con tokens de variables de entorno que se expanden en .git/config y .gitmodules, y luego se transmiten a hosts controlados por el atacante durante operaciones de fetch o pull."}], "lastModified": "2026-10-24T15:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "1E6164AE-7EF0-4E9A-9086-5EEB90FBEFEB", "versionEndExcluding": "3.1.55"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}