{"id":"CVE-2026-67322","summary":"GitPython before 3.1.52 Environment Variable Exfiltration via clone_from","details":"GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret.","aliases":["GHSA-rwj8-pgh3-r573"],"modified":"2026-09-10T03:47:36.102175820Z","published":"2026-08-01T12:22:17.009Z","related":["openSUSE-SU-2026:11466-1"],"database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67322.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67322.json"},{"type":"ADVISORY","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gitpython-developers/gitpython","events":[{"introduced":"0"},{"fixed":"3eafc576b523b7862ddf5a3875b4721b60f2f2e2"}],"database_specific":{"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:gitpython_project:gitpython:*:*:*:*:*:python:*:*","extracted_events":[{"introduced":"0"},{"fixed":"3.1.52"}]}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-67322.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}