High
python-git — security advisory
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
- Products
- python-git
- Affected versions
- 0.3.2~RC1-2, 0.3.2~RC1-3, 0.3.2~RC1-3ubuntu0.1~esm1, 0.3.2~RC1-3ubuntu0.1~esm2, 0.3.2~RC1-3ubuntu0.1~esm3, 1.0.1+git137-gc8b8379-1, 1.0.1+git137-gc8b8379-2, 1.0.1+git137-gc8b8379-2.1, 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1, 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2, 1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4, 2.1.11-1, 2.1.5-1, 2.1.6-1, 2.1.7-1, 2.1.8-1, 2.1.8-1ubuntu0.1~esm1, 2.1.8-1ubuntu0.1~esm2, 2.1.8-1ubuntu0.1~esm4, 3.0.4-1, 3.0.5-1, 3.0.7-1, 3.0.7-1ubuntu0.1~esm1, 3.0.7-1ubuntu0.1~esm2, 3.0.7-1ubuntu0.1~esm4, 3.1.14-1, 3.1.23-1, 3.1.24-1, 3.1.24-1ubuntu0.1~esm1, 3.1.24-1ubuntu0.1~esm2, 3.1.24-1ubuntu0.1~esm3, 3.1.30-1, 3.1.37-1, 3.1.37-3, 3.1.37-3ubuntu0.1~esm2, 3.1.44-1, 3.1.45-1, 3.1.46-1, 3.1.46-1ubuntu0.1~esm1, 3.1.50-1, 3.1.61-1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-73622
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:16 UTC · Revision 1
Source evidence
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.
osv:UBUNTU-CVE-2026-73622
python-git
Fixed versions: Not specified
python-git
Fixed versions: Not specified
python-git
Fixed versions: Not specified
python-git
Fixed versions: Not specified
python-git
Fixed versions: Not specified
python-git
Fixed versions: Not specified
python-git
Fixed versions: Not specified
python-git
Fixed versions: Not specified
Complete source record
{
"id": "b2d0703610a77b4783d015ebb95bc6494dbb14e5d9efec2c3877b6ec770be226",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-73622",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-73622",
"summary": "GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.",
"evidence": "osv:UBUNTU-CVE-2026-73622",
"products": [
{
"name": {
"value": "python-git",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.3.2~RC1-2",
"evidence": "/affected/0/versions"
},
{
"value": "0.3.2~RC1-3",
"evidence": "/affected/0/versions"
},
{
"value": "0.3.2~RC1-3ubuntu0.1~esm1",
"evidence": "/affected/0/versions"
},
{
"value": "0.3.2~RC1-3ubuntu0.1~esm2",
"evidence": "/affected/0/versions"
},
{
"value": "0.3.2~RC1-3ubuntu0.1~esm3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "python-git",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.1+git137-gc8b8379-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.0.1+git137-gc8b8379-2",
"evidence": "/affected/1/versions"
},
{
"value": "1.0.1+git137-gc8b8379-2.1",
"evidence": "/affected/1/versions"
},
{
"value": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1",
"evidence": "/affected/1/versions"
},
{
"value": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2",
"evidence": "/affected/1/versions"
},
{
"value": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "python-git",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.1.5-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.1.6-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.1.7-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.1.8-1",
"evidence": "/affected/2/versions"
},
{
"value": "2.1.8-1ubuntu0.1~esm1",
"evidence": "/affected/2/versions"
},
{
"value": "2.1.8-1ubuntu0.1~esm2",
"evidence": "/affected/2/versions"
},
{
"value": "2.1.8-1ubuntu0.1~esm4",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "python-git",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.1.11-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.0.4-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.0.5-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.0.7-1",
"evidence": "/affected/3/versions"
},
{
"value": "3.0.7-1ubuntu0.1~esm1",
"evidence": "/affected/3/versions"
},
{
"value": "3.0.7-1ubuntu0.1~esm2",
"evidence": "/affected/3/versions"
},
{
"value": "3.0.7-1ubuntu0.1~esm4",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "python-git",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.14-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.1.23-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.1.24-1",
"evidence": "/affected/4/versions"
},
{
"value": "3.1.24-1ubuntu0.1~esm1",
"evidence": "/affected/4/versions"
},
{
"value": "3.1.24-1ubuntu0.1~esm2",
"evidence": "/affected/4/versions"
},
{
"value": "3.1.24-1ubuntu0.1~esm3",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "python-git",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.30-1",
"evidence": "/affected/5/versions"
},
{
"value": "3.1.37-1",
"evidence": "/affected/5/versions"
},
{
"value": "3.1.37-3",
"evidence": "/affected/5/versions"
},
{
"value": "3.1.37-3ubuntu0.1~esm2",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "python-git",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.46-1",
"evidence": "/affected/6/versions"
},
{
"value": "3.1.50-1",
"evidence": "/affected/6/versions"
},
{
"value": "3.1.61-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "python-git",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.1.44-1",
"evidence": "/affected/7/versions"
},
{
"value": "3.1.45-1",
"evidence": "/affected/7/versions"
},
{
"value": "3.1.46-1",
"evidence": "/affected/7/versions"
},
{
"value": "3.1.46-1ubuntu0.1~esm1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-73622",
"aliases": [
"UBUNTU-CVE-2026-73622"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-git",
"purl": "pkg:deb/ubuntu/python-git?arch=source&distro=esm-infra-legacy%2Ftrusty",
"ecosystem": "Ubuntu:Pro:14.04:LTS"
},
"versions": [
"0.3.2~RC1-2",
"0.3.2~RC1-3",
"0.3.2~RC1-3ubuntu0.1~esm1",
"0.3.2~RC1-3ubuntu0.1~esm2",
"0.3.2~RC1-3ubuntu0.1~esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73622.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-git",
"binary_version": "0.3.2~RC1-3ubuntu0.1~esm3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-git",
"purl": "pkg:deb/ubuntu/python-git?arch=source&distro=esm-apps-legacy%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"1.0.1+git137-gc8b8379-1",
"1.0.1+git137-gc8b8379-2",
"1.0.1+git137-gc8b8379-2.1",
"1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm1",
"1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm2",
"1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73622.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-git",
"binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
},
{
"binary_name": "python3-git",
"binary_version": "1.0.1+git137-gc8b8379-2.1ubuntu0.1~esm4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-git",
"purl": "pkg:deb/ubuntu/python-git?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"2.1.5-1",
"2.1.6-1",
"2.1.7-1",
"2.1.8-1",
"2.1.8-1ubuntu0.1~esm1",
"2.1.8-1ubuntu0.1~esm2",
"2.1.8-1ubuntu0.1~esm4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73622.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python-git",
"binary_version": "2.1.8-1ubuntu0.1~esm4"
},
{
"binary_name": "python3-git",
"binary_version": "2.1.8-1ubuntu0.1~esm4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-git",
"purl": "pkg:deb/ubuntu/python-git?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"2.1.11-1",
"3.0.4-1",
"3.0.5-1",
"3.0.7-1",
"3.0.7-1ubuntu0.1~esm1",
"3.0.7-1ubuntu0.1~esm2",
"3.0.7-1ubuntu0.1~esm4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73622.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-git",
"binary_version": "3.0.7-1ubuntu0.1~esm4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-git",
"purl": "pkg:deb/ubuntu/python-git?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"3.1.14-1",
"3.1.23-1",
"3.1.24-1",
"3.1.24-1ubuntu0.1~esm1",
"3.1.24-1ubuntu0.1~esm2",
"3.1.24-1ubuntu0.1~esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73622.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-git",
"binary_version": "3.1.24-1ubuntu0.1~esm3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-git",
"purl": "pkg:deb/ubuntu/python-git?arch=source&distro=esm-apps%2Fnoble",
"ecosystem": "Ubuntu:Pro:24.04:LTS"
},
"versions": [
"3.1.30-1",
"3.1.37-1",
"3.1.37-3",
"3.1.37-3ubuntu0.1~esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73622.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-git",
"binary_version": "3.1.37-3ubuntu0.1~esm2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-git",
"purl": "pkg:deb/ubuntu/python-git?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"3.1.46-1",
"3.1.50-1",
"3.1.61-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73622.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-git",
"binary_version": "3.1.61-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python-git",
"purl": "pkg:deb/ubuntu/python-git?arch=source&distro=esm-apps%2Fresolute",
"ecosystem": "Ubuntu:Pro:26.04:LTS"
},
"versions": [
"3.1.44-1",
"3.1.45-1",
"3.1.46-1",
"3.1.46-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-73622.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "python3-git",
"binary_version": "3.1.46-1ubuntu0.1~esm1"
}
]
}
}
],
"modified": "2026-10-17T13:01:04.508014421Z",
"provider": "osv",
"upstream": [
"CVE-2026-73622"
],
"references": [
"https://ubuntu.com/security/CVE-2026-73622",
"https://www.cve.org/CVERecord?id=CVE-2026-73622",
"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67",
"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2",
"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add"
]
},
"related_cves": [
{
"value": "CVE-2026-73622",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 360932,
"published_at": "2026-08-13T12:17:00+00:00"
}