Is CVE-2026-110855 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110855?

CVE-2026-110855 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-110855

Description

GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs.