PatchSiren cyber security CVE debrief
CVE-2026-63728 gitleaks CVE debrief
CVE-2026-63728 is a template injection vulnerability in Gitleaks prior to 8.30.1. Attackers can leverage non-hermetic Sprig template functions to read arbitrary environment variables and exfiltrate sensitive data by crafting malicious report templates. This vulnerability allows attackers who can supply or influence report templates to extract credentials, tokens, and API keys from the host process and exfiltrate them through DNS queries, including secrets discovered during the scan itself. Users of Gitleaks should be aware of the potential risks and take steps to mitigate the vulnerability.
- Vendor
- gitleaks
- Product
- Unknown
- CVSS
- HIGH 8.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Users of Gitleaks prior to version 8.30.1 should be aware of this vulnerability and take steps to mitigate it. This includes restricting access to report template creation and ensuring that templates are thoroughly reviewed and validated. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and take necessary actions to protect their systems.
Technical summary
The vulnerability exists due to the use of non-hermetic Sprig template functions in Gitleaks report templates. An attacker can craft malicious templates using functions like env, expandenv, and getHostByName to extract sensitive data, such as credentials, tokens, and API keys, from the host process. This data can be exfiltrated through DNS queries. The vulnerability affects Gitleaks prior to version 8.30.1 and can be mitigated by restricting access to report template creation and ensuring that templates are thoroughly reviewed and validated.
Defensive priority
High
Recommended defensive actions
- Restrict access to report template creation to authorized personnel
- Thoroughly review and validate report templates
- Upgrade to Gitleaks version 8.30.1 or later
- Monitor for suspicious activity related to report template usage
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-21T00:17:48.953Z and has been modified since then. The NVD entry is currently being reviewed. Limited information is available about the vulnerability, and further investigation is recommended. The vulnerability exists in Gitleaks prior to version 8.30.1, and attackers can leverage non-hermetic Sprig template functions to read arbitrary environment variables and exfiltrate sensitive data by crafting malicious report templates. Users should verify their deployments and review official advisories for affected scope and severity.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T00:17:48.953Z and has been modified since then. The NVD entry is currently being reviewed.