Malicious Git Configurations Enable Code Execution on Developer Machines

What the New Flaws Reveal

Security researchers at Manifold Security have identified a set of eight vulnerabilities that affect seven popular command line coding assistants. The root cause is a feature of Git repositories that allows a repository to specify a command in its configuration file. When a developer clones a compromised repository, the assistant reads the configuration and runs the specified command on the developer's machine. The command runs with the same privileges as the user and does not trigger any approval dialog.

How Malicious Git Configurations Work

Git stores configuration data in a file named .git/config. This file can contain a section called core.hooksPath or other hook related entries that point to scripts. Some coding assistants automatically invoke Git hooks to retrieve context or to perform cleanup. If the assistant trusts the repository's configuration, it will execute the command listed in the hook without additional verification.

The execution flow looks like this:

1. A developer clones a repository that contains a malicious .git/config entry.
2. The coding assistant starts and reads the repository metadata.
3. It discovers a command reference such as a custom hook.
4. The assistant runs the command directly on the host system.
5. The command can download additional payloads, modify files, or exfiltrate data.

Because the command runs outside the assistant's sandbox, it inherits the user's rights. On a machine where the developer has administrative privileges, the impact can be severe.

Affected Coding Assistants

The disclosed vulnerabilities span a range of tools that are marketed as code generation or code completion helpers. The affected products include:

• Claude
• Codex
• Cursor
• Additional unnamed command line assistants that rely on Git metadata for context

Four of the eight flaws remain unpatched at the time of publication, meaning that attackers can still exploit them in the wild.

Real World Exploitation Scenarios

To understand the risk, consider a typical development workflow. A developer discovers a new open source library on a public platform and decides to clone the repository. The repository contains a hidden .git/config entry that points to a script named install.sh. The coding assistant, believing the script is part of the project's build process, runs it automatically. The script then performs the following actions:

1. Downloads a remote binary disguised as a dependency.
2. Sets the binary as executable and adds it to the system path.
3. Executes the binary, which establishes a reverse shell to an attacker-controlled server.

Because the assistant does not ask for confirmation, the developer may never notice the intrusion until unusual network activity appears.

Supply Chain Implications

These flaws extend the attack surface of the software supply chain. Organizations that rely on automated assistants to speed up development may inadvertently introduce malicious code into their code base. The risk is amplified in environments where developers have elevated permissions, such as CI/CD pipelines that run on privileged agents.

Mitigation Strategies for Developers

Developers can adopt several practical steps to reduce exposure:

• Review the contents of .git/config before running any assistant that interacts with a new repository.
• Disable automatic execution of Git hooks in the assistant settings, if the option exists.
• Run assistants inside a dedicated, low‑privilege container or virtual environment.
• Keep the operating system and development tools up to date with the latest security patches.
• Monitor network traffic for unexpected outbound connections during development sessions.

For teams that use shared development machines, applying group policies that restrict execution of unknown scripts can provide an additional safety net.

Recommendations for Tool Vendors

Vendors of command line coding assistants should treat the findings as a call to harden their products. Suggested actions include:

• Implement a validation step that checks the origin of any Git configuration command before execution.
• Prompt the user for explicit consent when a repository contains a hook or custom command.
• Offer a sandboxed mode that isolates all external commands from the host environment.
• Publish clear security advisories and provide a fast‑track patching process for discovered flaws.
• Collaborate with the broader open source community to develop best practices for handling repository metadata.

Adopting standards such as those outlined by the NIST software supply chain guidance can help align product security with industry expectations.

Broader Industry Context

The issue of malicious repository configuration is not new. Similar attacks have been reported in the past, often leveraging Git hooks or submodule features. The CVE database lists several entries that describe code execution through repository metadata. The current set of flaws is notable for its focus on AI powered assistants, but the underlying mechanism applies to any tool that trusts repository configuration without verification.

Security frameworks such as the OWASP Top Ten emphasize the importance of validating external inputs, a principle that directly applies to Git configuration data. Developers are encouraged to treat repository files as untrusted until proven otherwise.

Practical Steps for Secure Development

Below is a concise checklist that development teams can adopt:

1. Before cloning, scan the repository URL against known threat intelligence feeds.
2. After cloning, run git config --list --show-origin to see where each setting originates.
3. Disable or remove any suspicious entries, especially those that reference scripts or external commands.
4. Configure assistants to run in read‑only mode when accessing new repositories.
5. Document any exceptions to the policy and review them regularly.

By integrating these practices into the daily workflow, teams can keep the benefits of automated assistants while limiting exposure to malicious configuration attacks.

Staying informed about emerging threats and applying a layered defense strategy remains the most effective way to protect development environments from this class of vulnerability.