GitPython's _clone() method improperly expands environment variables in the separate_git_dir parameter derived from attacker-controlled .gitmodules submodule names. This leads to disclosure of environment variable values as persistent directory names on disk and in debug logs when DEBUG-level logging is enabled. The vulnerability affects versions from 0.7.0 up to but not including 2.4.5_7. A fix is available in version 2.4.5_7.