CVE-2026-73622
Received Received - Intake

GitPython Remote URL Variable Expansion Flaw Exposes Secrets

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73622
EUVD
EUVD-2026-57826

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gitpython gitpython to 3.1.55 (exc)
gitpython_developers gitpython to 3.1.55 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling. Attackers can craft URLs with environment variable tokens (e.g., ${AWS_SECRET_ACCESS_KEY}) that get expanded into .git/config and .gitmodules. These expanded URLs are then transmitted to attacker-controlled hosts during fetch or pull operations, potentially exposing secrets like AWS credentials or GitHub tokens.

Detection Guidance

Check for GitPython versions 3.1.53 and earlier using pip show GitPython or pip list. Inspect .git/config and .gitmodules files for URLs containing environment variable references like ${VARIABLE_NAME}. Monitor network traffic for unexpected outbound connections during git fetch or pull operations.

Impact Analysis

If you use GitPython versions 3.1.53 or earlier, an attacker could trick you into adding a malicious remote URL via Repo.create_remote() or Remote.add(). This could leak sensitive environment variables stored in your system, such as API tokens, credentials, or other secrets, when the remote is accessed during fetch or pull operations.

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, violating confidentiality requirements in GDPR and HIPAA. If secrets like API keys or user credentials are leaked, it may result in non-compliance with data protection regulations, potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Upgrade GitPython to version 3.1.55 or later. Review and update remote URLs in .git/config and .gitmodules to remove any environment variable references. Avoid using untrusted URLs in git operations until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73622. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart