Loading vulnerability…
Environment Variable Secret Exfiltration in GitPython
CVE-2026-73622 is an information disclosure vulnerability in GitPython's Remote.create() and Submodule.add() URL handling. Affected versions fail to disable environment variable expansion when processing attacker-supplied URLs. Variable references embedded in these URLs can expand into sensitive environment values stored in repository or submodule configuration and subsequently transmitted to attacker-controlled hosts during fetch or pull operations. The primary affected-version range is GitPython before 3.1.55.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can disclose credentials, tokens, and other secrets present in the GitPython process environment. Expanded values may persist in repository configuration and be transmitted during subsequent Git network operations. The vulnerability has high confidentiality impact; direct integrity or availability impacts are not established.
If you can’t patch tonight, do this now.
Do not pass untrusted repository or submodule URLs to Remote.create() or Submodule.add(). Restrict accepted URLs to trusted destinations and reject environment-variable references before processing. Remove unnecessary secrets from the environment of processes running GitPython, and restrict outbound Git connections to approved destinations.
Patch, then assume compromise.
Upgrade GitPython to version 3.1.57 or later, which includes the fix and addresses the related disclosed vulnerabilities. The minimum fixed version is inconsistently identified as 3.1.55 or 3.1.56; using 3.1.57 or later avoids this discrepancy. For distribution-managed installations, apply the vendor's patched GitPython package.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.