PT-2026-71450

CVE-2026-73622

Published

2026-07-24

Updated

2026-10-23

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.55

Description Improper handling of URL expansion in Remote.create() and Submodule.add() allows for the exfiltration of secrets. Attackers can provide URLs containing environment variable tokens that are expanded into the .git/config and .gitmodules files. These secrets are then transmitted to attacker-controlled hosts during fetch or pull operations.

Recommendations Update GitPython to version 3.1.55 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Alimony

Vendors

Affected products

Weakness enumeration

CWE-214: Invocation of Process Using Visible Sensitive Information

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor