High severity7.5NVD Advisory· Published Aug 13, 2026· Updated Oct 23, 2026
CVE-2026-73622
CVE-2026-73622
Description
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*+ 1 more
- cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*range: <3.1.55
- (no CPE)range: <3.1.55
Patches
Vulnerability mechanics
References
3- github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2nvdPatch
- github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67nvdExploitVendor Advisory
- www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-addnvdThird Party Advisory
News mentions
0No linked articles in our index yet.