CVE-2026-63728: Gitleaks Template Injection Vulnerability

CVE-2026-63728 Overview

CVE-2026-63728 is a template injection vulnerability in Gitleaks versions prior to 8.30.1. The flaw resides in the report template feature and stems from the use of non-hermetic Sprig template functions. Attackers who can supply or influence report templates can invoke env, expandenv, and getHostByName to read arbitrary environment variables from the host process. The extracted data can include credentials, API tokens, and secrets discovered during the scan itself, then be exfiltrated through DNS queries.

Critical Impact
Attackers can exfiltrate environment variables and scan-discovered secrets from CI/CD pipelines through DNS-based side channels, bypassing traditional egress controls.

Affected Products

Gitleaks versions prior to 8.30.1
CI/CD pipelines executing Gitleaks with custom report templates
Any workflow ingesting untrusted --report-template inputs

Discovery Timeline

2026-07-21 - CVE-2026-63728 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63728

Vulnerability Analysis

Gitleaks is a widely used secret scanning tool that supports custom report generation via Go templates. The tool enables the Sprig template library, which provides utility functions beyond Go's standard text/template package. Several Sprig functions are non-hermetic, meaning they interact with the host environment rather than remaining sandboxed to template inputs.

The report template feature exposes env, expandenv, and getHostByName to any template author. When a template is rendered, these functions execute with the privileges of the Gitleaks process. This behavior enables data exfiltration during what should be a read-only reporting operation. The vulnerability is classified under [CWE-1336] Improper Neutralization of Special Elements Used in a Template Engine.

Root Cause

The root cause is the inclusion of the full Sprig function set in the report template engine without filtering non-hermetic functions. The env and expandenv functions read process environment variables directly. The getHostByName function triggers DNS resolution, providing an outbound channel that often bypasses HTTP proxy egress rules. The fix in commit 83d9cd6 removes access to these functions from the template context.

Attack Vector

Exploitation requires the attacker to control or influence the report template supplied to Gitleaks. Common scenarios include a malicious pull request that modifies a repository-controlled .gitleaks.toml or template file, or a supply chain attack against a shared template. The attacker crafts a template that concatenates environment variable values into a DNS label, then calls getHostByName against an attacker-controlled domain. The DNS server logs the query and reconstructs the exfiltrated secret. Because Gitleaks frequently runs in CI/CD contexts with cloud credentials, registry tokens, and deployment keys in the environment, a single template injection can yield multiple high-value secrets.

The vulnerability mechanism is documented in the VulnCheck Gitleaks Advisory and the technical writeup on abusing Sprig for exfiltration.

Detection Methods for CVE-2026-63728

Indicators of Compromise

DNS queries to unfamiliar domains originating from CI/CD runners during Gitleaks execution
Report template files containing references to env, expandenv, or getHostByName Sprig functions
Unexpected modifications to .gitleaks.toml or template files in pull requests from external contributors
Outbound DNS queries with unusually long or high-entropy subdomain labels from build agents

Detection Strategies

Scan repository history and pull request diffs for template files invoking non-hermetic Sprig functions before Gitleaks executes
Correlate Gitleaks process execution with outbound DNS activity from build runners to identify anomalous resolution patterns
Enforce allow-lists on Gitleaks versions in CI/CD pipelines and alert when versions prior to 8.30.1 are invoked

Monitoring Recommendations

Log all DNS queries from CI/CD environments and baseline expected destinations
Monitor changes to Gitleaks configuration files and report templates through code review controls
Alert on any Gitleaks invocation using the --report-template flag with a template sourced from untrusted input

How to Mitigate CVE-2026-63728

Immediate Actions Required

Upgrade Gitleaks to version 8.30.1 or later across all CI/CD pipelines and developer workstations
Rotate secrets that may have been exposed in environments where Gitleaks ran with untrusted templates
Audit repositories for modifications to .gitleaks.toml and report template files introduced by external contributors

Patch Information

The vulnerability is remediated in Gitleaks 8.30.1. The fix is implemented in commit 83d9cd6, which strips the non-hermetic env, expandenv, and getHostByName functions from the Sprig function map used by the report template engine. Refer to the Gitleaks repository for release notes.

Workarounds

Restrict --report-template inputs to templates stored outside the scanned repository and controlled by trusted maintainers
Run Gitleaks in an environment stripped of sensitive environment variables, injecting only the minimum required for operation
Apply egress DNS filtering on CI/CD runners to block resolution of arbitrary external domains during scan execution

bash

# Upgrade Gitleaks to the patched version
go install github.com/gitleaks/gitleaks/v8@v8.30.1

# Verify the installed version
gitleaks version