CVE-2026-110855: Exposure of Sensitive Information to an Unauthorized Actor in gitpython-developers GitPython

GitPython prior to version 3.2.0 contains an information disclosure vulnerability due to improper handling of environment variable expansion in the Repo._clone() method. Specifically, the separate_git_dir parameter is passed to Git.polish_url() without disabling variable expansion (expand_vars=False). Attackers can craft .gitmodules submodule names containing environment variable syntax, causing the clone and submodule update operations to reveal secrets present in .git/modules directory names and DEBUG logs.

An attacker can cause sensitive information to be exposed during repository cloning and submodule updates by exploiting environment variable expansion in maliciously crafted submodule names. This leads to unauthorized disclosure of secrets contained in directory names and debug output. The vulnerability has a CVSS 4.0 score of 7.1 (high severity), indicating significant risk of information leakage without requiring privileges or user interaction beyond cloning a repository.

A fixed version of GitPython (3.2.0 or later) addresses this vulnerability by properly disabling environment variable expansion in the affected code path. Users should upgrade to GitPython version 3.2.0 or later to remediate this issue. No vendor advisory content was provided, so patch status is inferred from the version information. Patch status is confirmed by the version boundary indicating versions before 3.2.0 are affected.