https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T12:37:13.521755+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-73622 CVE-2026-73622 — GitPython before 3.1.55 Environment Variable Exfiltration via Remote.add() 2026-09-30T12:37:13.540516+00:00

Affected: gitpython-developers GitPython

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.