SB2026073117 - Information disclosure in GitPython

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026073117

SB2026073117 - Information disclosure in GitPython

Published: July 31, 2026

Security Bulletin ID SB2026073117
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in Repo.create_remote(), Remote.add(), and Submodule.add() when processing an attacker-controlled repository URL. A remote attacker can supply a URL containing environment-variable references to disclose sensitive information.

The supplied variable references are expanded server-side, stored in .git/config, and the resulting secret-bearing URL is transmitted on the next fetch, pull, or remote update. In the Submodule.add() path, the expanded URL is also written to .gitmodules.


Remediation

Install update from vendor's website.

References