AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-73622

HIGH · CVSS 7.5 EPSS 0.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-13 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

GitPython versions prior to 3.1.55 are vulnerable due to improper handling of environment variable expansion in URL processing within Remote.create() and Submodule.add(). This flaw allows attackers to craft malicious URLs that can exfiltrate sensitive information from .git/config and .gitmodules files to external servers during fetch or pull operations. Organizations using GitPython should prioritize updating to the latest version to mitigate the risk of secret leakage.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-73622
Severity
HIGH
CVSS
7.5
EPSS
0.28%

Original NVD Description

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.