The vulnerability in GitPython prior to version 3.1.55 involves improper handling of environment variable expansion in the Remote.create() and Submodule.add() functions when processing URLs. Attackers can supply URLs containing environment variable tokens that are expanded into sensitive configuration files such as .git/config and .gitmodules. These expanded values are then transmitted to attacker-controlled hosts during Git fetch or pull operations, resulting in exposure of sensitive information to unauthorized actors. The CVSS 4.0 score is 8.7, indicating high severity due to network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Sensitive information contained in Git configuration files (.git/config and .gitmodules) can be exfiltrated to attacker-controlled hosts without any authentication or user interaction. This exposure could lead to disclosure of secrets or credentials stored in these files, potentially compromising the security of the affected systems or repositories.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects GitPython before 3.1.55, upgrading to version 3.1.55 or later is likely the intended remediation once officially released. Until then, avoid using untrusted URLs in Remote.create() and Submodule.add() operations or apply any temporary mitigations recommended by the vendor.