7.5highHigh
CVE-2026-73622
Gitpython Project Gitpython
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
Exploitation status
- Published references include exploit or proof-of-concept material. There is no confirmation it is being used in real attacks.
- A vendor advisory or patch reference has been published.
What the metrics mean
- It is reachable over a network, without needing local access.
- For an attacker who can reach it, no special conditions are needed to exploit it.
- To exploit it, no account is needed.
- Beyond that, no action by a user is required.
Scoring
- CVSS
- 7.5 (v3.1)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- CVSS v4
- 8.7
- Weakness
- CWE-200
- Assigned by
- disclosure@vulncheck.com
Dates
- Published
- 2026-08-13
- Last modified
- 2026-09-03
- Sources
- NVD
Affected products
- Gitpython Project Gitpython- 3.1.55
As listed in the NVD configuration data. Not a statement about your estate.
References
- https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67
- https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add
- https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67