CVE-2026-110855

6.5 MEDIUMpublic exploit available

Published 2026-10-14 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses

CWE-200

Public exploit & PoC references

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94

All references

https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94
https://www.vulncheck.com/advisories/gitpython-before-3.2.0-environment-variable-disclosure-via-gitmodules-submodule-name
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100149PoC
HIGHCVE-2026-100241
HIGHCVE-2026-100244
MEDIUMCVE-2026-100286
UNSCOREDCVE-2026-100377
UNSCOREDCVE-2026-100379PoC
UNSCOREDCVE-2026-100406PoC
MEDIUMCVE-2026-100418PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.