—

PYSEC-2026-3951

Quick fix

PYSEC-2026-3951 — gitpython: upgrade to the fixed version with the command below.

pip install --upgrade 'gitpython>=3.1.55'

Details

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/gitpython

Introduced in: 0Fixed in: 3.1.55

Fixpip install --upgrade 'gitpython>=3.1.55'

References

https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add[ADVISORY]
https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2[FIX]
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67[EVIDENCE]