[GHSA-94p4-4cq8-9g67] GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

[nikpivkin]

Updates

• Affected products

Comments
The vulnerable range should be < 3.1.55, not <= 3.1.53. The first patched version 3.1.55 is correct.

The fix commit linked in the advisory is gitpython-developers/GitPython@8634174 (#2181). Tag 3.1.55 contains it and tag 3.1.54 does not. In 3.1.54 Remote.create in git/remote.py still calls Git.polish_url(url) with the default expand_vars=True, and 3.1.55 changes it to expand_vars=False. The 3.1.54 release only has #2180, which is a different change.

So version 3.1.54 is still vulnerable but is outside the current range.

[github]

Hi there @Byron! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

Copilot review overview

🟢 Approval recommended

The advisory now consistently identifies all versions before 3.1.55 as affected.

Review effort: Balanced
Findings: None

What changed in this PR

Updates the GitPython advisory so version 3.1.54 remains included in the vulnerable range.

Changes:

• Removes the stale <= 3.1.53 affected-version metadata.
• Retains 3.1.55 as the first patched version.
• Updates the advisory modification timestamp.

File	Description
GHSA-94p4-4cq8-9g67.json	Corrects affected-version metadata.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Byron]

While I didn't check this, it seems the PR enlarges the list of vulnerable GitPython releases, which should always be 'safer' than before.