Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-73622GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()

High 7.5

In plain English

A high-severity information exposure in GitPython from gitpython-developers. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 56.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	python-git	3.1.30-1+deb12u3	DEBIAN-CVE-2026-73622
Debian:13	python-git	3.1.44-1+deb13u1	DEBIAN-CVE-2026-73622
Debian:14	python-git	3.1.61-1	DEBIAN-CVE-2026-73622
PyPI	gitpython	3.1.55	GHSA-94p4-4cq8-9g67
PyPI	gitpython	3.1.55	PYSEC-2026-3951
Ubuntu:26.10	python-git	no fix listed	UBUNTU-CVE-2026-73622

Affected products (as reported)

Vendor	Product	Versions
gitpython-developers	GitPython	0 – before 3.1.55

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-94p4-4cq8-9g67) vendor-advisory
Patch Commit patch
VulnCheck Advisory: GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() third-party-advisory