CVE-2026-73622 in GitPython
Summary
by MITRE • 08/13/2026
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in GitPython versions prior to 3.1.55 represents a critical security flaw in how the library handles URL processing within remote repository operations and submodule management functions. This issue stems from inadequate sanitization of environment variable references in URL strings passed to Remote.create() and Submodule.add() methods, creating a path for malicious actors to exploit environment variable expansion mechanisms during Git operations.
The technical implementation of this vulnerability occurs when attackers supply specially crafted URLs containing environment variable tokens such as $HOME, $USER, or custom variables that are subsequently processed by the underlying Git commands. These URL strings undergo expansion within the .git/config and .gitmodules configuration files, where environment variable references are resolved to their actual values before being stored in the repository metadata. The expanded values are then transmitted during fetch or pull operations to remote hosts specified in the attack payload.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to exfiltrate sensitive environment variables that may contain credentials, API keys, or other confidential information. When GitPython processes these malicious URLs, the resolved environment variable values become part of the repository configuration and are transmitted during network operations, potentially reaching attacker-controlled servers. This creates a persistent threat vector where even after initial compromise, attackers can maintain access through automated retrieval of expanded environment variables during routine Git operations.
This vulnerability aligns with CWE-15 Environment Variable Issues, specifically addressing the improper handling of environment variables in input validation and processing contexts. The flaw also intersects with ATT&CK technique T1552.001 Unsecured Credentials, as it enables unauthorized access to credential material stored in environment variables through Git configuration files. Additionally, the vulnerability demonstrates characteristics of privilege escalation through configuration manipulation, as attackers can inject malicious URLs that persist in repository metadata and affect all subsequent Git operations.
Mitigation strategies should prioritize immediate upgrade to GitPython version 3.1.55 or later, which implements proper URL sanitization and environment variable expansion prevention mechanisms. Organizations should also implement network monitoring to detect unusual outbound connections from Git operations, particularly those targeting non-standard domains or IP addresses. Configuration management practices should include regular auditing of .git/config and .gitmodules files for suspicious entries, while security teams should establish policies restricting the use of environment variables in Git URL handling within automated build and deployment pipelines.