CVE-2026-67322

GitPython before 3.1.52 leaks process environment variables through Repo.clone_from(), because the caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms runs os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens, which are expanded to the hosting process's environment variable values (such as AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN) at clone time. The expanded URL, now containing the secret, is transmitted over the network to the attacker-controlled host during the clone attempt, giving the attacker credential disclosure with no integrity or availability impact. Any Python application, CI pipeline, or automation service that passes attacker-influenced URLs to GitPython's clone functions is affected. There are no confirmed reports of exploitation in the wild (EPSS 0.3%, not in CISA KEV), but a public advisory with proof-of-concept details is available and a fixed release, 3.1.52, exists.

What to do: Upgrade to GitPython 3.1.52 or later. As interim mitigations, avoid passing untrusted URLs to Repo.clone_from()/Git.clone, strip or escape '$' characters in remote URLs before use, and restrict which environment variables are visible to processes that clone attacker-supplied repositories. Audit hosts where untrusted clones have been attempted for signs that secret-bearing environment variables were sent to external hosts.