---
id: CVE-2026-63728
title: >-
  Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in
  Report Template Feature
summary: >-
  Gitleaks prior to 8.30.1 contains a template injection vulnerability that
  allows attackers who can supply or influence report templates to read
  arbitrary environment variables and exfiltrate sensitive data by leveraging
  non-hermetic Spri…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-1336
vendor: gitleaks
product: gitleaks
affected:
  - gitleaks < 8.30.1
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-22T13:55:17.985985Z'
exploitAvailable: true
published: '2026-07-20'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T14:18:08.292Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63728'
references:
  - url: 'https://github.com/gitleaks/gitleaks'
    label: Product
  - url: >-
      https://github.com/gitleaks/gitleaks/commit/83d9cd684c87d95d656c1458ef04895a7f1cbd8e
    label: Patch Commit
  - url: >-
      https://fatihhcelik.github.io/posts/gitleaks-abusing-sprig-for-exfiltration/#the-fix
    label: Blog Post
  - url: >-
      https://www.vulncheck.com/advisories/gitleaks-secret-exfiltration-via-non-hermetic-sprig-template-functions-in-report-template-feature
tags:
  - cve.org
  - exploit-available
epss: 0.00206
epssPercentile: 0.09553
ingestedAt: '2026-09-24T15:45:56.723Z'
---

## Overview

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report templates using the env, expandenv, and getHostByName functions to extract credentials, tokens, and API keys from the host process and exfiltrate them through DNS queries, including secrets discovered during the scan itself.

## Affected

- `gitleaks < 8.30.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.