What’s Vulnerable › Vulnerabilities

CVE-2026-73622: GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-08-13 · updated 2026-10-24
• Weakness: CWE-200

Description

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

Affected products

• gitpython-developers GitPython: before 3.1.55 — fixed in 3.1.55

How to fix

Upgrade to a fixed version: gitpython-developers GitPython 3.1.55. Check the vendor advisory for mitigations.

References

• https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67
• https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add
• https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67

Get alerted when CVE-2026-73622 or the next vulnerability affects your stack