CVE-2026-110855 — GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule Name
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(),…
Published: 2026-10-14 · CVSS: 7.1 · CVSS 4.0
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7