CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

🗓️ 20 Jul 2026 23:32:34Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Gitleaks before 8.30.1 allows template injection to read environment variables and exfiltrate secrets via domain name system exfiltration.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-63728	20 Jul 202623:32	–	attackerkb
Circl	CVE-2026-63728	21 Jul 202602:48	–	circl
CVE	CVE-2026-63728	20 Jul 202623:32	–	cve
Cvelist	CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature	20 Jul 202623:32	–	cvelist
EUVD	EUVD-2026-46134	21 Jul 202600:30	–	euvd
NVD	CVE-2026-63728	21 Jul 202600:17	–	nvd
Positive Technologies	PT-2026-61746	20 Jul 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-63728	21 Jul 202616:51	–	redhatcve
Vulnrichment	CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature	20 Jul 202623:32	–	vulnrichment

Source	Link
fatihhcelik	www.fatihhcelik.github.io/posts/gitleaks-abusing-sprig-for-exfiltration/
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63728.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-63728
vulncheck	www.vulncheck.com/advisories/gitleaks-secret-exfiltration-via-non-hermetic-sprig-template-functions-in-report-template-feature
github	www.github.com/gitleaks/gitleaks/commit/83d9cd684c87d95d656c1458ef04895a7f1cbd8e
github	www.github.com/gitleaks/gitleaks

24 Jul 2026 03:57Current

5.6Medium risk

Vulners AI Score5.6

CVSS 48.1

EPSS0.00145