Threats tagged 'brew-legit-cve-2026-67322'

GitPython versions up to 3.1.50 contain a vulnerability where the Repo.clone_from() method passes the clone URL through os.path.expandvars(), causing environment variables in the URL to be expanded server-side. This can lead to exfiltration of sensitive environment variables such as AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN to an attacker-controlled host. The issue arises because polish_url() applies environment variable expansion indiscriminately to URLs, without scheme checks or opt-outs. The vulnerability is fixed in version 1.2.0.post0_11.