CVE-2026-73622: GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitPythonto a version that resolves this vulnerability.Fixed in 3.1.55 - Configuration
In GitPython, ensure environment variable expansion is disabled when handling Remote.create() and Submodule.add() URLs so that tokenized URLs are not expanded into .git/config and .gitmodules.
GitPython Remote.create()/Submodule.add() URL handling environment variable expansion = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73622?
The severity of CVE-2026-73622 is rated high with a score of 7.5.
How do I fix CVE-2026-73622?
To fix CVE-2026-73622, update GitPython to version 3.1.55 or later.
What kind of vulnerability is CVE-2026-73622?
CVE-2026-73622 is an information leak vulnerability that allows the exfiltration of sensitive environment variables.
Who is affected by CVE-2026-73622?
Users of GitPython versions prior to 3.1.55 are affected by CVE-2026-73622.
What can attackers do with CVE-2026-73622?
Attackers can exfiltrate secrets by crafting URLs that include environment variable references using CVE-2026-73622.