GHSA-RWJ8-PGH3-R573: GHSA-RWJ8-PGH3-R573: Environment Variable Exfiltration and Protocol Validation Bypass in GitPython

#security #cve #cybersecurity #ghsa

GHSA-RWJ8-PGH3-R573: Environment Variable Exfiltration and Protocol Validation Bypass in GitPython

Vulnerability ID: GHSA-RWJ8-PGH3-R573
CVSS Score: 10.0
Published: 2026-07-21

An input validation flaw in GitPython allows remote attackers to exfiltrate system environment variables and bypass safe-protocol restrictions via crafted repository URLs passed to the clone API.

TL;DR

Unsanitized URL evaluation in GitPython's clone API automatically expands environment variables, exposing credentials and enabling protocol validation bypasses.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-200, CWE-20
Attack Vector: Network (AV:N)
Estimated CVSS Score: 10.0
Impact: Information Disclosure and Arbitrary Code Execution
Exploit Status: Proof of Concept (PoC) Available
KEV Status: Not Listed

Affected Systems

GitPython
GitPython: < 3.1.52 (Fixed in: 3.1.52)

Code Analysis

Commit: 8ac5a30

Address vulnerability where environment variables are expanded in untrusted repository URLs, leading to potential credentials exfiltration and protocol bypass.

Exploit Details

GitHub: Official Pull Request and regression tests validating exfiltration vectors on mock environments.

Mitigation Strategies

Upgrade GitPython to version 3.1.52 or later
Sanitize user-provided URLs to reject $, %, and ~ characters before passing to GitPython APIs
Implement outbound network egress filtering to restrict unauthorized git connections

Remediation Steps:

Update your project dependencies file to specify GitPython>=3.1.52
Run your dependency manager installer (e.g., pip install --upgrade GitPython)
Deploy code-level validation checks to verify incoming repository URLs do not contain variable expansion strings
Verify system environment variables to minimize exposure of high-privilege credentials inside application runtimes

References

Read the full report for GHSA-RWJ8-PGH3-R573 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community