Environment Variable Exfiltration in GitPython Versions Prior to 3.1.52

CVE-2026-67322

What is CVE-2026-67322?

GitPython versions before 3.1.52 have a vulnerability that allows for environment variable exfiltration through the Repo.clone_from() method. If an attacker can control the remote URL used in this method call, they can manipulate the URL to include tokens that expand to sensitive environment variable values (e.g., AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN). This leads to the unintentional transmission of these secrets to an attacker-controlled destination during the cloning process, posing serious security risks to affected systems.

References