High [CVE-2026-73622] Information disclosure via environment variable expansion in URL handling

GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references.

Attackers can craft URLs with environment variable tokens that are expanded into.git/config and.gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations. A flaw was found in GitPython.

This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. This is an Important information disclosure flaw in GitPython.

This occurs because environment variable expansion is not disabled in URL handling, leading to secrets being embedded in Git configuration and transmitted to attacker-controlled hosts. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Weakness: CWE-914. Affected Red Hat products: Red Hat Satellite 6.19 for RHEL 9; Red Hat OpenShift AI 2.25; Exploit Intelligence; Migration Toolkit for Applications 8; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Satellite 6.