Environment Variable Exfiltration in GitPython by GitPython Developers
CVE-2026-73622

8.7HIGH

Key Information:

Vendor

Gitpython-developers

Status
Gitpython
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73622?

GitPython prior to version 3.1.55 contains a vulnerability that allows malicious actors to exfiltrate sensitive information. This occurs through the improper handling of environment variable expansions during URL processing in Remote.create() and Submodule.add() methods. Attackers can construct URLs that leverage environment variable tokens, which when executed, expose .git/config and .gitmodules content and send it to unauthorized hosts during fetch or pull operations. It’s essential for users to update to the latest version to mitigate this risk.

Affected Version(s)

GitPython 0 < 3.1.55

GitPython 3.1.55

References

https://github.com/gitpython-developers/GitPython/securit...
vendor-advisory
https://github.com/gitpython-developers/GitPython/commit/...
patch
https://www.vulncheck.com/advisories/gitpython-before-env...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

alimony
.