Vulnerability Description
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitpython Project | Gitpython | < 3.1.55 |
Related Weaknesses (CWE)
References
- https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9Patch
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-ExploitVendor Advisory
- https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfilThird Party Advisory
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-ExploitVendor Advisory
FAQ
What is CVE-2026-73622?
CVE-2026-73622 is a vulnerability with a CVSS score of 7.5 (HIGH). GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing varia...
How severe is CVE-2026-73622?
CVE-2026-73622 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-73622?
Check the references section above for vendor advisories and patch information. Affected products include: Gitpython Project Gitpython.