CVE-2026-67322 GitPython before 3.1.52 Environment Variable Exfiltration via clone_from
Attackers can exfiltrate environment variables by crafting malicious clone URLs, exposing secrets like API keys to remote hosts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67322?
CVE-2026-67322 is a high-severity vulnerability in gitpython-developers GitPython, published on 1 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret.
Weakness: CWE-200
Which versions are affected by CVE-2026-67322?
3 open source packages ship an affected version, including gitpython and GitPython. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gitpython PyPI | All versions | 3.1.52 |
gitpython PyPI | All versions | 3.1.52 |
GitPython PyPI | All versions | 3.1.52 |
Products include Gitpython Project Gitpython.
How do I fix CVE-2026-67322?
Upgrade gitpython to 3.1.52 or later.
Is CVE-2026-67322 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67322 exists.
Other vulnerabilities in gitpython-developers GitPython
- CVE-2023-40267 GitPython vulnerable to remote code execution due to insufficient sanitization of input arguments
- CVE-2026-78676 GitPython before 3.1.59 Remote Code Execution via Config Injection
- CVE-2026-67324 GitPython 3.1.50 Authentication Bypass via Joined Short Options
- CVE-2026-42215 GitPython: Command injection via Git options bypass
- CVE-2026-87817 GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation
Sources
Also known as DEBIAN-CVE-2026-67322, ECHO-8b1b-6d4c-bcd1, GHSA-rwj8-pgh3-r573, MINI-6wwr-68q2-6xmp, MINI-gpjr-634j-7hcx, MINI-h5vp-9jg3-fcpj and 7 more.