Homepage

Information Exposure The advisory has been revoked - it doesn't affect any version of package python3.12-gitpython  (opens in a new tab)

Threat Intelligence

EPSS
0.28% (20th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-PYTHON312GITPYTHON-19140757
  • published21 Aug 2026
  • disclosed1 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 1 Aug 2026

CVE-2026-67322  (opens in a new tab)
CWE-214  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3.12-gitpython package and not the python3.12-gitpython package as distributed by RHEL.

GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the URL before invoking git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that are expanded to the values of the hosting process's environment variables (e.g., AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN). The resulting URL, now containing the secret, is transmitted over the network to an attacker-controlled host during the clone attempt, disclosing the secret.