GitPython before version 3.1.52 is vulnerable to exposure of sensitive environment variables during repository cloning. The vulnerability arises in the Repo.clone_from() function, which uses Git.polish_url() to process the remote URL. On non-Cygwin platforms, Git.polish_url() calls os.path.expandvars() on the URL, expanding any environment variable tokens embedded by an attacker. This results in secrets from the hosting process's environment being included in the URL transmitted over the network to an attacker-controlled server, leading to sensitive information disclosure.

An attacker who can control the clone URL can cause the hosting process to leak environment variables containing sensitive information such as credentials or tokens. This disclosure occurs without authentication or user interaction and can lead to compromise of secrets used by the application or environment. The vulnerability has a high severity score (CVSS 8.7) due to the network exposure of sensitive data and lack of required privileges or user interaction.

A patch is available that fixes this vulnerability in GitPython version 3.1.52 and later. Users should upgrade to version 3.1.52 or newer to remediate the issue. Since this is a cloud service, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor that their environment is updated accordingly. Until patched, avoid cloning from untrusted or attacker-controlled URLs that could embed environment variable tokens.