GitPython versions prior to 3.1.52 allow an attacker who can influence the clone URL to embed environment variable expansion tokens such as $NAME or ${NAME}. When the URL is processed by Git.polish_url(), the implementation on non‑Cygwin platforms calls os.path.expandvars(), which expands these tokens to the values of environment variables in the host process. The resulting URL, now containing the expanded values, is transmitted over the network to the target repository location. If the repository host is controlled by the attacker, the expanded secrets—such as AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN—are exposed remotely, leading to a confidentiality breach of sensitive credentials. The weakness is classified as CWE‑200 and CWE‑214, reflecting unauthorized disclosure of information. The vulnerability is exploited via normal clone operations; an attacker does not need elevated privileges beyond the ability to supply a malicious URL to a process executing Repo.clone_from().

The affected product is GitPython, maintained by gitpython-developers. All releases earlier than version 3.1.52 are vulnerable. The issue arises on environments that are not Cygwin, as the indirect call to os.path.expandvars() occurs only in those contexts. Users of this library in CI/CD pipelines, development tools, or any scripts that perform remote repository cloning are at risk if their application permits untrusted URLs.

The CVSS score of 8.7 places this flaw in the high severity range. The EPSS score of 0.00266 (0.266%) indicates a low but non‑zero probability of exploitation, meaning that while attacks are unlikely, the potential impact remains high. The vulnerability is not currently listed in the CISA KEV catalog, indicating no publicly known, actively exploited instances at the time of assessment. Attackers can feasibly target systems that run GitPython in environments where environment variables contain high‑value secrets. The exploit is straightforward: supply a crafted clone URL to the vulnerable process and observe the exfiltrated secret in the outbound network connection.