GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Gitpython-developers
  • Gitpython
Gitpython Project
  • Gitpython

Configuration 1 [-]

cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*

No data.

References
Link Providers
https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2 cve-icon cve-icon cve-icon
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67 cve-icon cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-73622 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-73622 cve-icon
https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add cve-icon cve-icon cve-icon
History

Sat, 15 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-914
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 14 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Gitpython Project
Gitpython Project gitpython
CPEs cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*
Vendors & Products Gitpython Project
Gitpython Project gitpython

Thu, 13 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Gitpython-developers
Gitpython-developers gitpython
Vendors & Products Gitpython-developers
Gitpython-developers gitpython

Thu, 13 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Description GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
Title GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-08-13T11:28:22.807Z

Updated: 2026-08-14T16:52:41.181Z

Reserved: 2026-08-13T11:17:25.160Z

Link: CVE-2026-73622

cve-icon Vulnrichment

Updated: 2026-08-13T12:56:58.006Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-13T12:17:27.337

Modified: 2026-09-03T16:09:30.803

Link: CVE-2026-73622

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-13T11:28:22Z

Links: CVE-2026-73622 - Bugzilla