CVE-2026-110855

Executive Summary

CVE-2026-110855 is an information disclosure vulnerability in GitPython versions before 3.2.0. When cloning a malicious repository, the library's Repo._clone() method calls Git.polish_url() without passing expand_vars=False, allowing environment variable expansion within a crafted .gitmodules submodule name. Successful exploitation exposes secrets that are reflected into .git/modules directory names and DEBUG-level logs. The flaw carries a CVSS v3.1 base score of 6.5 and requires user interaction.

Technical Analysis

GitPython is a Python library used to interact with Git repositories programmatically. The vulnerability resides in the repository cloning flow, specifically in the Repo._clone() method. According to the NVD description, this method invokes Git.polish_url() without the expand_vars=False argument, which means that environment variable expansion is enabled by default during URL polishing.

Environment variable expansion in Git allows strings containing variable syntax to be resolved against the process environment. In a benign context, this is used for configuration flexibility (for example, $HOME or $USER expansion). However, when a remote repository controls an input that passes through this expansion logic, an attacker can inject variable references into that input.

The injection vector is the .gitmodules file. This file, which is present in repositories that contain Git submodules, stores submodule metadata including the submodule name and path. GitPython processes the .gitmodules file during clone and submodule operations. Because the submodule name is attacker-controlled and flows into Git.polish_url() with variable expansion enabled, an attacker can define a submodule name such as one containing variable syntax.

When the clone operation runs (and subsequently when submodule_update is invoked), the expansion mechanism resolves the injected variable syntax against the environment of the process running GitPython. The resolved values are then reflected in two places:

1. .git/modules directory names — the submodule name is used to construct the on-disk module directory path, so resolved secrets become part of directory names.
2. DEBUG logs — the library logs the processed URLs and paths, leaking the resolved values into log output.

The confidentiality impact is rated High (C:H) because environment variables frequently contain credentials, tokens, API keys, and other secrets. The integrity and availability impacts are None. The attack vector is Network (AV:N) since the malicious repository can be hosted remotely; the attack complexity is Low (AC:L); no privileges are required (PR:N); and user interaction (UI:R) is required because a victim or automated process must initiate the clone. Scope is Unchanged (S:U).

The core weakness is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The root cause is an insecure default in the API contract: not passing expand_vars=False when the input is not trusted.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE. The attack chain below is inferred strictly from the vulnerability class and the NVD description; no specific code patterns or undocumented function names are asserted.

1. Reconnaissance / target identification. The attacker identifies a target that uses a vulnerable GitPython version (before 3.2.0) and that clones repositories from a source the attacker can influence — for example, a CI/CD runner cloning a pull request branch, a build system cloning a dependency repository, or a developer cloning an untrusted third-party repository. The attacker needs the target to clone a repository they control or a repository into which they can commit a .gitmodules file.

2. Triggering the flaw class. The attacker crafts a repository containing a .gitmodules file whose submodule name includes environment-variable-style syntax. Because GitPython's Repo._clone() path reaches Git.polish_url() without expand_vars=False, the variable syntax in the submodule name is not treated as literal text but is expanded against the environment variables of the process performing the clone. This is the specific flaw class: unsafe expansion of attacker-controlled input (environment variable injection / information disclosure).

3. Payload / execution method. The payload is the crafted submodule name in .gitmodules (a repository artifact, not executable code). The victim action is cloning the repository and, per the description, running submodule_update. During these operations the injected variable references are resolved. No code execution occurs; the "execution" is the expansion of the attacker's variable references using the victim process's environment.

4. Post-exploitation impact. The resolved secret values appear in two observable locations: .git/modules directory names on the filesystem and DEBUG log output. An attacker who can read either location — directly, or indirectly via a subsequent artifact such as a build cache, container image layer, or shared log store — recovers the secrets. This enables credential theft, lateral movement, or supply-chain pivoting depending on which environment variables were exposed (for example cloud provider credentials, deployment tokens, or package registry tokens).

The attack is opportunistic in the sense that the attacker does not need to know the variable names in advance if they can guess common ones (for example $HOME, $USER, and other conventional variables), while more targeted attacks can attempt to reference variables known to be present in the target environment. Actual success depends on which secrets are present in the environment at clone time.

Impact Assessment

Business impact centers on confidentiality of secrets present in the environment of the process performing the clone. Because CVSS rates confidentiality as High with no integrity or availability impact, the primary business risk is unauthorized disclosure of credentials and tokens, which can cascade into broader compromise. Affected systems include developer workstations, CI/CD runners, build containers, and any automation that uses GitPython to clone untrusted repositories.

The blast radius depends on deployment patterns. A developer workstation exposes that developer's environment; a shared CI runner may expose secrets scoped to that pipeline or, worse, to the organization. Systems that commit build artifacts, caches, or logs to shared storage can propagate the exposed secrets beyond the immediate host. Because the vulnerability is Network-vector and low-complexity, and because the attacker payload is a normal repository artifact, detection is difficult once the artifact is created. The requirement for user interaction means an attacker likely relies on social engineering, dependency-confusion-style naming, or control of an upstream repository used by the target.

There is no CISA KEV entry and no known exploit in the wild at this time. EPSS has not been scored by FIRST.org, and no EPSS value should be assumed.

Detection Guidance

Sigma Rule

title: GitPython Clone Environment Variable Expansion Information Disclosure
id: 9f2c7c1e-4b3a-4d2e-9a11-0c1e5f7a8b21
status: experimental
description: Detects Git submodule operations where a .gitmodules submodule name contains environment-variable syntax, a pattern consistent with CVE-2026-110855 exploitation via GitPython Repo._clone().
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110855
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  category: process_creation
detection:
  selection_git:
    Image|endswith:
      - '/git'
      - '/git.exe'
  selection_submodule_ops:
    CommandLine|contains:
      - 'submodule update'
      - 'submodule init'
      - 'clone'
  selection_var_syntax:
    CommandLine|contains:
      - '$HOME'
      - '$USER'
      - '$TOKEN'
      - '${'
  condition: selection_git and selection_submodule_ops and selection_var_syntax
falsepositives:
  - Legitimate use of variable syntax in documented git workflows
level: medium

YARA Rule

rule CVE_2026_110855_GitPython_EnvVar_Submodule
{
    meta:
        description = "Detects .gitmodules files with submodule names containing environment variable syntax indicative of CVE-2026-110855 exploitation"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110855"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $gitmodules = "[submodule"
        $var1 = "${"
        $var2 = "$HOME"
        $var3 = "$USER"
        $var4 = "$TOKEN"
        $path = "path ="

    condition:
        $gitmodules and $path and any of ($var*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110855 GitPython submodule env var expansion attempt - .gitmodules with variable syntax"; flow:established,to_client; content:".gitmodules"; http.uri; content:"[submodule"; content:"${"; distance:0; within:256; classtype:attempted-recon; reference:cve,2026-110855; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110855; sid:2026110855; rev:1;)

Elastic Detection

process where process.name == "git" and
  process.args : ("clone", "submodule") and
  process.parent.name : ("python", "python3", "pip", "pytest", "celery", "uwsgi") and
  process.command_line : ("*$HOME*" or "*$USER*" or "*${*")

Splunk SPL Query

index=main sourcetype=linux_audit OR sourcetype=sysmon
(process_name="git" OR process_name="git.exe")
(process_args="*clone*" OR process_args="*submodule update*")
(process_args="*${*" OR process_args="*$HOME*" OR process_args="*$USER*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_name, process_args
| sort -count

Wazuh OSSEC Rule

<group name="gitpython,cve_2026_110855,">
  <rule id="110855" level="8">
    <decoded_as>json</decoded_as>
    <field name="process.name">git</field>
    <field name="process.args">clone|submodule</field>
    <field name="process.args">\$HOME|\$USER|\$\{</field>
    <description>CVE-2026-110855: Git clone/submodule operation with environment variable syntax in arguments, possible GitPython information disclosure attempt.</description>
    <mitre>
      <id>T1552</id>
    </mitre>
    <group>cve_2026_110855,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

   • Scrub sensitive environment variables from the environment of any process that uses GitPython to clone untrusted repositories. Use minimal-environment execution (for example env -i wrappers or secret-injection mechanisms that mount secrets only at the point of use, not as process-wide variables).
   • Avoid cloning untrusted repositories with vulnerable GitPython versions. Where possible, clone from trusted mirrors or pinned commits only.
   • Disable DEBUG-level logging for GitPython in CI/CD and production environments, and ensure logs are access-controlled, since DEBUG logs are an exposure channel for this flaw.
   • Restrict read access to .git/modules directories and build caches, since directory names may contain expanded secrets.
   • If the library's API permits it in the deployed context, ensure any internal clone wrappers pass expand_vars=False where the underlying API supports it; verify against the target version's actual API before relying on this.

2. Patch / upgrade steps.

   • Upgrade GitPython to 3.2.0 or later, which per the NVD description removes the vulnerable behavior. Validate the upgrade in a staging environment before production rollout.
   • Pin the minimum GitPython version in dependency manifests and lockfiles; add a policy check that rejects versions below 3.2.0.
   • Rebuild and redeploy container images and virtual environments that bundled an affected version.

3. Long-term hardening.

   • Treat repository content (.gitmodules, submodule names, URLs) as untrusted input and audit any code path that passes it into a function with expansion or templating semantics.
   • Adopt a secrets-management pattern that never exposes long-lived credentials as environment variables in clone-capable processes.
   • Add dependency scanning that tracks GitPython versions and flags sub-3.2.0 installs.
   • Rotate any credentials that were present in environments that cloned untrusted repositories while a vulnerable version was in use, since exposure via logs or directory names may be undetectable after the fact.

References

• NVD — CVE-2026-110855: https://nvd.nist.gov/vuln/detail/CVE-2026-110855
• GitPython project repository and changelog (verify 3.2.0 release notes): https://github.com/gitpython-developers/GitPython
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-110855 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is available. No threat actor campaign or exploit-in-the-wild evidence is associated with this CVE at the time of writing.