GitPython Environment Variable Exfiltration via Repo.create_remote() (GHSA-rwj8-pgh3-r573 incomplete fix)

Vulnerability Overview Title: Environment-variable exfiltration via / URL (incomplete fix of GHSA-rwj8-pgh3-r573) Description: This vulnerability results from an incomplete fix for . While has stopped passing caller-provided URLs through , and still allow this behavior by default, passing to . This allows attackers to exfiltrate sensitive information from environment variables (such as , , etc.) by constructing malicious URLs. Impact Scope Affected Versions: GitPython = 3.1.55 CVSS v3 Score: 7.5/10 Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None Remediation 1. Recommended Fix: - Pass in the remaining URL-invoking methods to align with the clone fix. - A more robust approach is to change the default value of to , requiring callers to explicitly opt-in to local path expansion. 2. Specific Fix Steps: - Modify the method in to pass to . - Modify the method in to pass to . POC Code Cleanup Impact Any secrets present in the hosted process environment (such as , , CICD tokens, etc.) will be leaked to a remote URL controlled by the attacker and passed to or . The secrets are expanded immediately into and transmitted over the network during the subsequent . This is part of the "import repository from URL" attack model described in the documentation. CI servers, git hosting servers, and dependency scanners are all susceptible to this attack. The same disclosure vector propagates through .

Goal Reached Thanks to every supporter — we hit 100%!

GitPython Environment Variable Exfiltration via Repo.create_remote() (GHSA-rwj8-pgh3-r573 incomplete fix)

More from this source