Summary
GitPython's Repo.clone_from() leaks environment variables when processing attacker-controlled clone URLs using os.path.expandvars().
If an attacker can influence the remote URL, they can cause secrets such as cloud credentials or access tokens to be substituted into the URL and exfiltrated over the network during the clone operation.
Affected context
This vulnerability appears in applications or automation scripts that use GitPython's Repo.clone_from() with remote URLs that are not fully trusted.
On non-Cygwin platforms, the library applies environment-variable expansion to the URL before invoking git clone, which can inject sensitive values into the outgoing request.
The risk is most pronounced in CI/CD pipelines, deployment tooling, or services that both store secrets in environment variables and accept user-controlled or indirectly influenced repository URLs.
Exploit preconditions
- Attack surface: Any code path that calls Repo.clone_from() with a URL that can be set or influenced by an external party (e.g., request parameters, job definitions, config files).
- Required access: Ability to supply or modify the clone URL value, either directly through an API or indirectly through configuration.
- Trigger point: The call to Git.polish_url() inside Repo.clone_from(), which invokes os.path.expandvars() on the URL on non-Cygwin systems.
- Why exploitation is possible: Environment-variable expansion is applied to untrusted URLs, so $VAR or ${VAR} segments are replaced with process environment values and then sent over the network as part of the git clone request to an attacker-controlled host.
Why this happens
The underlying flaw is an information exposure pattern where sensitive process state (environment variables) is implicitly mixed into untrusted data.
GitPython's Git.polish_url() method invokes os.path.expandvars() on the caller-supplied URL, causing any $NAME or ${NAME} placeholders to be replaced with environment variable values.
Because this transformation occurs on potentially attacker-controlled input, secrets present in the hosting process environment become part of the outbound URL, aligning with CWE-200: Information Exposure through unintended inclusion of confidential data in externally visible communications.
Potential impact
- Secrets such as cloud access keys, CI/CD access tokens, or API keys may be disclosed to attacker-controlled servers.
- Compromise of cloud infrastructure or repositories if leaked credentials are used for unauthorized access.
- Lateral movement within build or deployment environments using harvested tokens.
- Long-term supply-chain risk if attackers maintain persistent access via stolen credentials.
General mitigation guidance
Mitigation centers on separating sensitive process state from untrusted URL handling and minimizing what environment data is ever interpolated.
Defensive patterns include:
- Avoiding environment-variable expansion on any input that may include untrusted or partially trusted data.
- Treating clone URLs and similar connection strings as opaque values and passing them directly to underlying tools without preprocessing.
- Constraining where secrets are stored and ensuring high-value credentials are not broadly available in process environments for tools that process user-controlled data.
- Introducing explicit allowlists or validation for acceptable URL formats before invoking clone operations or other network calls.
How teams detect issues like this
Potential detection approaches include:
- Static analysis checks for calls to os.path.expandvars(), os.path.expanduser(), or similar APIs on data derived from external inputs such as HTTP parameters, job configs, or user-specified URLs.
- Code review guidelines that flag any preprocessing of network endpoints with environment expansion or string templating using process secrets.
- Logging and monitoring of outbound git clone traffic, especially unusual destinations or URLs containing recognizable secret patterns (e.g., keys, tokens).
- Integration of automated secure coding checks in CI pipelines to enforce policies around environment-variable usage in URL handling code.
