Threats tagged 'brew-cruft-cve-2026-67322'

GitPython versions up to 3.1.50 contain a vulnerability where the Repo.clone_from() method passes the remote URL through os.path.expandvars(), causing environment variables in the URL to be expanded server-side. This allows an attacker controlling the URL to exfiltrate environment variables such as AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN by embedding them in the URL, which is then sent over the network to an attacker-controlled host. The vulnerability affects all non-Cygwin platforms and is due to polish_url() applying environment variable expansion indiscriminately to remote URLs. A fix is available in version 2.16.0_11.