GitSpawn Flaws Let Malicious .git Configs Run Attacker Code in Claude Code, Cursor, Codex, and Other AI Coding Agents
Manifold Security found eight flaws across seven AI coding agents that let a repository's git config silently execute code the moment it is opened.
Editor's Note ·
- Correction:
- The article presents the following as a direct quote from goose's GitHub security advisory (GHSA-r5pp-p5r8-466r): "The goose review command executes system git without sanitizing user-controlled configurations. A malicious repository containing a [core] fsmonitor setting in .git/config triggers arbitrary command execution when git refreshes its index during diff operations—before any model interaction or approval occurs." The advisory's actual text reads: "goose review command runs the system git to gather the diff it reviews, without stripping attacker-controlled git config. A malicious repository whose .git/config sets [core] fsmonitor = <command> causes git to execute that command on the host during its index refresh (git diff HEAD)... The command executes before goose ever contacts the model." The substance is accurate but the quoted wording is a paraphrase, not a verbatim reproduction of the source.
- Clarification:
- The claims attributed to Cyber Security News could not be verified against a committed source snapshot: the outlet's page returned HTTP 403 (bot-blocked) when the pipeline attempted to archive it. Verification instead relied on a live fetch of the page at review time rather than the archived snapshot used for the article's other two sources. Readers should verify claims attributed to Cyber Security News against the live page at https://cybersecuritynews.com/gitspawn-flaws-execute-code/.
Overview
Manifold Security has disclosed eight security flaws, collectively named “GitSpawn,” across seven command-line AI coding agents, according to The Hacker News. The flaws let a repository’s own git configuration specify a command that runs on a developer’s machine the moment an AI coding agent opens the project, according to Cyber Security News.
What We Know
The vulnerability class exploits core.fsmonitor, a Git performance setting whose value is a command that git executes automatically to identify changed files, which git reads from the repository’s own .git/config file, according to The Hacker News. Git operations as routine as git status and git diff trigger that command, and AI coding agents call these commands in the background at session startup to work out the current branch and changed files, according to The Hacker News.
Manifold framed the underlying issue plainly: “The vulnerability is not in the model, or in anything new. It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is,” according to The Hacker News.
The attack requires the repository to arrive as files with its .git directory intact — preserved through shared archives, drives, sync folders, or USB sticks, but not through a standard git clone, according to The Hacker News. Cyber Security News described the same precondition: the poisoned repository has to arrive “through a zipped folder, a shared drive, a synced directory, or a USB stick, exactly the way colleagues and consultants routinely hand off projects,” according to Cyber Security News.
According to The Hacker News, three tools have shipped fixes — goose, Claude Code, and Cursor — while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code execution path remained vulnerable as of September 1. Cyber Security News independently confirmed the same overall pattern, listing goose, Cursor, and Codex as patched and Hermes Agent, Qwen Code, and Grok Build as still vulnerable, according to Cyber Security News.
Execution timing varies by tool: on Claude Code and Hermes Agent the payload fires before the workspace-trust prompt is accepted, on Qwen Code it fires before the user has authenticated, and on Grok Build it fires on the first keystroke, according to The Hacker News.
The best-documented single flaw affects the goose CLI. According to its GitHub security advisory, “The goose review command executes system git without sanitizing user-controlled configurations. A malicious repository containing a [core] fsmonitor setting in .git/config triggers arbitrary command execution when git refreshes its index during diff operations—before any model interaction or approval occurs.” The advisory assigns the flaw CVE-2026-72718, rates it 7.0 (High) on the CVSS 4.0 scale, credits Francisco Rosales of Manifold Security with the report, and lists all goose versions before 1.44.0 as affected, with 1.44.0 shipping the fix.
Both outlets report no confirmed exploitation of any of the disclosed flaws in the wild, according to The Hacker News.
Mitigation
Both outlets recommend inspecting .git/config before opening a directory received as raw files rather than through a clone, according to Cyber Security News. The Hacker News detailed the specific commands: checking git config --get core.fsmonitor in repositories that arrived that way, auditing global configuration with git config --global --list | grep fsmonitor, and disabling the setting by default with git config --global core.fsmonitor false, according to The Hacker News.
What We Don’t Know
Neither outlet names all eight flaws individually or details every affected agent’s exact vulnerable and patched version numbers beyond goose. It is not yet clear when Hermes Agent, Qwen Code, Grok Build, and the remaining Claude Code execution path will receive fixes, or what specific remediation each vendor plans.