PT-2026-114169 · Gitpython Developers · Gitpython
CVE-2026-110855
·
Published
2026-10-14
·
Updated
2026-10-14
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate git dir in Repo. clone(), which omits expand vars=False when calling Git.polish url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule update exposes secrets in .git/modules directory names and DEBUG logs.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitpython