What is CVE-2026-73622?

CVE-2026-73622 is a high-severity vulnerability in Gitpython-developers Gitpython, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-08-13.

How severe is CVE-2026-73622?

High severity. CVSS v3 base score is 7.5 out of 10.

Information disclosure in Gitpython-developers Gitpython

CVE-2026-73622

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URL…

Vulnerability class: Information Disclosure

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Gitpython-developers Gitpython — versions 0, 3.1.55

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-73622?: CVE-2026-73622 is a high-severity vulnerability in Gitpython-developers Gitpython, classified under Information Disclosure. CVSS score: 7.5/10. Published 2026-08-13.
How severe is CVE-2026-73622?: High severity. CVSS v3 base score is 7.5 out of 10.