Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 7.5, published 1 August 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-07-16: Version 3.1.52 contains the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

GitPython environment-variable exfiltration in Repo.clone_from()

Severity: high · CVSS 7.5 · Published 2026-08-01

GitPython is a widely-used library for programmatically interacting with Git repositories. When an application uses the Repo.clone_from() method to clone a repository from a URL supplied by an untrusted source (such as a CI/CD pipeline or dependency scanner), the URL is processed through a function that expands environment variables embedded in the URL. An attacker can craft a malicious URL containing environment-variable tokens (e.g., $AWS_SECRET_ACCESS_KEY) that are automatically replaced with their actual values before the clone attempt. This causes sensitive credentials to be transmitted over the network to an attacker-controlled server, exposing secrets with no user interaction or additional preconditions required.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 7.5, published 1 August 2026.
Which products and versions are affected?: GitPython GitPython <= 3.1.51.
Is there a fix for This vulnerability?: A patch was published on 2026-07-16: Version 3.1.52 contains the fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a credential exposure flaw (CWE-200) in the Git.polish_url() method, a local-path normalization helper that is unconditionally applied to remote clone URLs. On non-Cygwin platforms, polish_url() calls os.path.expandvars() on the input URL, which substitutes $NAME and ${NAME} tokens with the corresponding environment-variable values from the hosting process. An attacker controlling the URL argument to Repo.clone_from() (as in "import repository from URL" features of CI servers, mirrors, and scanners) can embed such tokens; the expanded URL—now containing the literal secret—is passed to the git clone subprocess, which transmits it to the attacker-named host via HTTP(S) or DNS. The unsafe-protocol filter runs before expansion, allowing an attacker with environment-variable write access to additionally bypass protocol restrictions. GitPython 3.1.52 and later patch this by removing or restricting environment-variable expansion on remote URLs. No attack preconditions beyond the ability to supply a clone URL are required; no user interaction is necessary.

Affected products

GitPython GitPython <= 3.1.51

Timeline

2026-07-16: disclosed
2026-08-01: advisory
2026-07-16: patched: Version 3.1.52 contains the fix
2026-09-08: other: Duplicate advisory GHSA-m4f3-g4cq-hqrx withdrawn in favor of primary GHSA-rwj8-pgh3-r573

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.