Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2026-67322: GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from()

42
This week
HIGH 7.5REMOTEUPGRADE

CVE-2026-67322 is a high-severity flaw (CVSS 7.5) affecting gitpython. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_

Why this priority

  • High severity
  • Public exploit reference
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score7.5 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance0.3% (top 75%)
CISA exploited listNo
WeaknessCWE-200
Published2026-08-01
Last modified2026-10-23
Publisher (CNA): VulnCheck · Vendor: gitpython project

Am I affected?

Timeline

gitpython project gitpython UPGRADE
Affected: < 3.1.52
Fixed in: 3.1.52
Safe to downgrade to: no unaffected older release
1. Check installed version
pip show gitpython
2. UPGRADE to 3.1.52
pip install --upgrade "gitpython>=3.1.52"
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

References

← Back to latest CVEs