CVE-2026-110855

Awaiting Analysis Awaiting Analysis - Queue

GitPython Information Disclosure via Environment Variable Expansion

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110855

EUVD

EUVD-2026-101738

Affected Vendors & Products

Vendor	Product	Version / Range
gitpython-developers	GitPython	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

GitPython before 3.2.0 has an information disclosure flaw where malicious repositories can expose environment variables. This happens because Repo._clone() uses Git.polish_url() without setting expand_vars=False, allowing .gitmodules submodule names with variable syntax to reveal secrets in .git/modules directory names and DEBUG logs.

Detection Guidance

This vulnerability can be detected by checking for GitPython versions before 3.2.0 and inspecting .gitmodules files for environment variable syntax in submodule names. Review DEBUG logs for exposed secrets in .git/modules directory names.

Impact Analysis

If you use GitPython versions before 3.2.0, attackers could exploit this to leak sensitive environment variables from your system. This might include secrets like API keys or passwords stored in environment variables, potentially leading to unauthorized access or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized exposure of personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage due to data leaks.

Mitigation Strategies

Upgrade GitPython to version 3.2.0 or later to address the information disclosure vulnerability. Review .gitmodules files for suspicious submodule names containing variable syntax that could expose secrets.

Hi! I’m here to help you understand CVE-2026-110855. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70