Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-110855

GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

gitpython-developers GitPython

Default version status: unaffected

  • 0 to < 3.2.0affected
  • 3.2.0unaffected
pkg:pypi/GitPython

References