CVE-2026-67322 Details
Description
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret.
A vulnerability in GitPython versions prior to 3.1.52 allows for environment-variable exfiltration through the Repo.clone_from() method. The issue arises because the user-supplied remote URL is processed by Git.polish_url(), which on non-Cygwin platforms, applies os.path.expandvars() to the URL before executing the git clone command. This behavior enables an attacker controlling the clone URL to insert tokens that are replaced with the values of the server's environment variables, such as AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN. The modified URL, now containing sensitive information, is sent over the network to an attacker-controlled host during the cloning process, thereby disclosing the secret.
Users can upgrade to GitPython version 3.1.52 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573 | [email protected] | ExploitVendor Advisory |
| https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gitpython project gitpython | < 3.1.52 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | Initial Analysis | [email protected] |
| Aug 3, 2026 | CVE Modified | CISA-ADP |
| Aug 1, 2026 | New CVE Received | [email protected] |