Threats tagged 'brew-fdroidserver-cve-2026-73622'

GitPython versions prior to 2.4.5_2 have a vulnerability where environment variables in URLs passed to Repo.create_remote() or Remote.add() are expanded and embedded into the repository configuration. This can lead to sensitive environment variables being written into .git/config and transmitted to an attacker-controlled server during fetch or pull operations. The issue arises because the fix for a previous similar vulnerability did not cover these API calls, leaving the default behavior of expanding variables enabled. A patch is available in version 2.4.5_2.