Skip to main content
VulnerabilityPublished 07/24/2026

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

Affects GitPythonSource GCVE Database

CVSS 3.1 base score
7.5High
Patch
Available – fixed in 3.1.55
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using Repo.create_remote() or Remote.add() with untrusted URLs containing environment variable expansions. Monitor GitPython releases for updates that disable environment variable expansion in these API calls, similar to the fix applied to Repo.clone_from().

Affected software

ProductAffectedFixed in
PyPIGitPythonAffected
  • <3.1.55
Fixed in
  • 3.1.55

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

GitPython versions prior to 3.1.55 contain a vulnerability where environment variables in URLs passed to Repo.create_remote() or Remote.add() are expanded and embedded into the repository configuration. This occurs because the fix for a prior vulnerability did not cover these API calls, leaving the default behavior to expand environment variables in URLs. As a result, sensitive environment secrets can be exfiltrated by embedding them in URLs that are stored in .git/config and transmitted to attacker-controlled hosts during fetch or pull operations.

Weaknesses

References