The CVSS 7.5 score for CVE-2026-73622 significantly understates the actual risk because it treats this as a straightforward path-injection flaw rather than what it truly is: an exploitation of a dangerous assumption that Git configuration files are passive storage rather than active data flows that trigger credential transmission.
When GitPython's Remote.create() writes an environment variable to .git/config (or when Submodule.add() writes to .gitmodules), it expands variables like $CI_TOKEN or $AWS_SECRET at write time. The expanded value—potentially containing production credentials—then becomes part of a configuration file that Git will consult during future fetch and pull operations. Those operations transmit the now-persisted value to whatever remote is configured, including URLs extracted from attacker-controlled submodule references. The attack requires no code execution, no memory corruption, and no privilege escalation — it simply waits for a legitimate Git operation to execute the exfiltration.
The patch in version 3.1.55 disables variable expansion entirely rather than adding context-aware guards. This is telling: it reflects that the maintainers recognized the exploit vector but could not enumerate where else similar assumptions might exist. The disabled feature will not disappear from demand — it will migrate to user-space workarounds: embedding secrets directly in URLs (worse), passing them as CLI arguments that leak into process arguments (worse), or custom pre-expansion wrappers (worst). Each workaround is strictly worse than the original behavior and critically, each one moves the vulnerable code outside the visibility of security tooling that was already failing to catch this. SAST tools can audit GitPython's Remote.create() — they have no prayer of auditing the proliferation of expansion implementations that will appear in CI configs and wrapper scripts across the ecosystem.
GitPython is disproportionately used in CI/CD pipelines and build systems — environments where credentials are abundant and often carry broad permissions. A malicious submodule URL processed by a CI job could silently exfiltrate the job's entire credential context. The EPSS score of 0.00282 was computed without accounting for these supply chain contexts, where the attack surface is orders of magnitude larger than a typical vulnerability.
The deeper question the patch raises: what other URL-handling code paths in GitPython contain similar assumptions about the passivity of configuration writes? The inherited trust model — that .git/config is always local, always yours — comes from Git itself and runs through JGit, libgit2, and every Git wrapper in every language. This vulnerability is not an isolated code defect; it is one instance of a category error that has appeared across Shellshock, Log4Shell, and now GitPython — treating configuration data as trusted input in contexts where it becomes an execution or transmission channel.