CVE-2026-73622

GitPython before 3.1.55 does not disable environment variable expansion when handling URLs passed to Remote.create() and Submodule.add(), so an attacker-supplied URL containing variable references is expanded before being written. The expanded values are stored in .git/config and .gitmodules and are then transmitted to attacker-controlled hosts when the repository performs fetch or pull operations. An attacker who can influence a remote or submodule URL can therefore read secrets held in environment variables (an information-disclosure impact, consistent with the CVSS 4.0 score of 8.7 with confidentiality impact only). Any application, CI pipeline, or tooling that uses GitPython to create remotes or add submodules with URLs not fully trusted is affected. Exploitation has not been reported in the wild; a public proof-of-concept advisory (GHSA-94p4-4cq8-9g67) exists and EPSS assigns a low 0.4% probability of exploitation in the next 30 days.

What to do: Upgrade GitPython to 3.1.55 or later. Until patched, avoid creating remotes or adding submodules with URLs derived from untrusted input, or validate/sanitize URLs for variable-reference characters before use. Audit .git/config and .gitmodules for unexpectedly expanded values, and rotate any secrets that may have been transmitted to untrusted hosts during fetch or pull operations.