{"cve":"CVE-2026-73622","nvd":{"published":"2026-08-13T12:17:27.337","modified":"2026-10-24T15:10:00.190","status":"Analyzed","description":"GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-200"],"references":["https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67","https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add","https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67"],"products":["gitpython_project:gitpython"],"source":"nvd","synced_at":"2026-10-24T16:53:35.584907681+00:00"},"epss":{"cve":"CVE-2026-73622","score":0.00514,"percentile":0.43493,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-94p4-4cq8-9g67","url":"https://osv.dev/vulnerability/GHSA-94p4-4cq8-9g67","summary":"GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)","modified":"2026-09-24T14:45:07.411775302Z","packages":[{"ecosystem":"PyPI","name":"gitpython","purl":"pkg:pypi/gitpython","ranges":["<3.1.55"],"fixed":["3.1.55"]}]},{"id":"PYSEC-2026-3951","url":"https://osv.dev/vulnerability/PYSEC-2026-3951","summary":"","modified":"2026-09-10T13:00:03.315495609Z","packages":[{"ecosystem":"PyPI","name":"gitpython","purl":"pkg:pypi/gitpython","ranges":["<3.1.55"],"fixed":["3.1.55"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}