CVE-2026-73622
Medium
Elevated severity or exploit probability.
CVSS base
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS — probability of exploitation (30 days)
0.4%
29.0th percentile
CISA KEV
Not listed
Weakness / dates
CWE-200
Published 2026-08-13 · modified 2026-09-03
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | N | None |
| Availability | N | None |
Timeline
- 2026-08-13 — Published (NVD)
- 2026-09-03 — Last modified (NVD)
Description
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
Affected
References
- https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2
- exploit https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67
- https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add
- exploit https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67