Git recursive clone submodule URL remote code execution

Successful exploitation can result in arbitrary code execution on the victim system at clone time. Because exploitation occurs when a user recursively clones a malicious repository containing a crafted .gitmodules file, the attacker can execute commands in the security context of the user running Git or an application embedding Git. This can lead to full compromise of developer workstations or automation environments that clone untrusted repositories, including theft or modification of source code, credential access, persistence, and further lateral movement depending on the privileges of the affected process.

Until patched, avoid recursively cloning or otherwise initializing submodules from untrusted repositories. In particular, avoid repositories whose submodule definitions are not trusted, since exploitation requires a malicious .gitmodules entry. Restrict or review use of submodules from third-party sources in developer and CI/CD environments until all Git clients and embedded Git distributions are updated.

Upgrade Git to a fixed release: 2.14.5 or later in the 2.14 series, 2.15.3 or later in the 2.15 series, 2.16.5 or later in the 2.16 series, 2.17.2 or later in the 2.17 series, 2.18.1 or later in the 2.18 series, or 2.19.1 or later. Also update applications that embed Git, specifically including GitHub Desktop, Atom, and any other software bundling a vulnerable Git client.