{"vulnerability": "CVE-2026-110855", "sightings": [{"uuid": "3788a86d-7d48-4c47-9934-5b4be0192f83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-110855", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117442268749107432", "content": "CVE-2026-110855 GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110855https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94https://www.vulncheck.com/advisories/gitpython-before-3.2.0-environment-variable-disclosure-via-gitmodules-submodule-name#gitpython-developers #GitPython#CVE_2026_110855#bot", "creation_timestamp": "2026-10-15T01:13:26.339514Z"}]}