Executive brief
GitPython, a popular library for interacting with Git repositories, contains a flaw that can leak sensitive server information. When an application uses GitPython to download (clone) a repository from a user-provided web address, an attacker can craft a special address that tricks the server into including its own secret internal data—such as AWS keys or GitHub tokens—in the request. This allows the attacker to steal credentials from the server running the GitPython code.
Technical details
The `Repo.clone_from()` and `Repo.clone()` methods pass the user-supplied URL to `Git.polish_url()`, which unconditionally calls `os.path.expandvars()` on non-Cygwin platforms. An attacker can provide a URL containing shell-style environment variable tokens (e.g., `$AWS_SECRET_ACCESS_KEY`). These tokens are expanded to their literal values server-side before being passed to the `git clone` subprocess. Consequently, the sensitive values are transmitted to the attacker's server via the resulting network request. Additionally, because expansion occurs after protocol validation, this can be used to bypass unsafe protocol filters if the attacker can influence environment variables. The issue is fixed in version 3.1.52.
Affected products
- gitpython-developers GitPython <= 3.1.51
Timeline
- 2026-07-16: advisory: Initial GitHub Advisory published
- 2026-07-21: patched: Advisory updated with patch information for version 3.1.52
References
- https://api.github.com/users/KrisKennawayDD
- https://github.com/KrisKennawayDD
- https://api.github.com/users/KrisKennawayDD/gists%7B/gist_id%7D
- https://api.github.com/users/KrisKennawayDD/repos
- https://avatars.githubusercontent.com/u/95245117?v=4
- https://api.github.com/users/KrisKennawayDD/events%7B/privacy%7D