CVE-2026-110855
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 14, 2026
Vendor
unknown
Description
GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.