CVE-2026-73622

Name
CVE-2026-73622
Description
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2
disclosure@vulncheck.com https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67
disclosure@vulncheck.com https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:* py3-gitpython >= None < 3.1.55

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
py3-gitpython edge-community 3.1.49-r0 Wen Heping <wenhepingalpine@sohu.com> possibly vulnerable
py3-gitpython edge-community 3.1.46-r1 Wen Heping <wenhepingalpine@sohu.com> possibly vulnerable
py3-gitpython edge-community 3.1.46-r0 Wen Heping <wenhepingalpine@sohu.com> possibly vulnerable
py3-gitpython edge-community 3.1.44-r0 None possibly vulnerable
py3-gitpython edge-community 3.1.43-r1 Bart Ribbers <bribbers@disroot.org> possibly vulnerable
py3-gitpython edge-community 3.1.37-r0 Bart Ribbers <bribbers@disroot.org> possibly vulnerable
py3-gitpython edge-community 3.1.35-r0 Bart Ribbers <bribbers@disroot.org> possibly vulnerable
py3-gitpython 3.24-community 3.1.49-r0 Wen Heping <wenhepingalpine@sohu.com> possibly vulnerable