GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name

影響: pip:GitPython <= 3.1.62 → 3.2.0

Repo._clone()'s handling of separate_git_dir never disables Git.polish_url()'s environment-variable expansion, unlike every other caller of that helper that handles attacker-influenced data. Since separate_git_dir can be derived from an attacker-controlled .gitmodules submodule name, a completely ordinary clone + submodule_update(init=True, recursive=True) on a malicious repository expands an environment variable of the attacker's choosing and exposes its value both as a persistent on-disk dire…

GitHub Advisory Databaseで読む

2026/10/28 00:26、GitHub Advisory Databaseが「GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。