CVE-2026-110855: GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separategitdir in Repo.clone(), which omits expandvars=False when calling Git.polishurl(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submoduleupdate exposes secrets in .git/modules directory names and DEBUG logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.2.0
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to convince a user or automated process to clone a malicious repository and run submodule_update. The malicious repository must contain a .gitmodules submodule name with environment-variable syntax.
What information can be exposed?
Environment-variable values can be expanded into paths under .git/modules. Those values may also be exposed through DEBUG logs.
Are installations using the affected package version range exposed by default?
Exposure requires cloning an attacker-controlled repository and processing its submodules; the provided information does not indicate that ordinary cloning without submodule_update triggers disclosure.
How can I check whether an environment may have been affected?
Review repositories cloned with GitPython for suspicious variable syntax in .gitmodules submodule names, and inspect .git/modules directory names and DEBUG logs for expanded secret values.