CVE-2026-73622
GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add()
HIGH 8.7
En bref
- Source
- NVD
- EPSS
- EPSS 0.51 % · centile 44 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- VulnCheck
- Statut NVD
- Analyzed
Description
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
| CVSS 4.0 | HIGH 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · disclosure@vulncheck.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · disclosure@vulncheck.com (Secondary) |
Avis
- GHSA-94p4-4cq8-9g67 — GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)
- PYSEC-2026-3951 — GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate se
Références européennes
- ENISA EUVD · EUVD-2026-57826
- GCVE · GCVE-0-2026-73622
Configurations affectées (CPE NVD)
cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*< 3.1.55
Produits affectés
| Produit | Versions |
|---|---|
| gitpython-developers · GitPython | affected 0 < 3.1.55 ; unaffected 3.1.55 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |