DIGGINGBEAGLE

Case · DiggingBeagle record

GitSpawn let received repositories execute code before AI coding-agent trust gates

Manifold Security disclosed a cross-vendor vulnerability class in which AI coding agents automatically ran Git commands while opening a repository and preserved attacker-controlled repository-local Git configuration. Command-bearing settings such as core.fsmonitor could therefore execute code as the developer before normal model, trust or tool-approval controls.

Agent authority
Scope

Defensive cross-vendor vulnerability research. The documented delivery condition is narrower than a hostile git URL: the victim must receive a project directory with attacker-controlled local .git configuration intact, such as an archive, shared volume, sync directory or copied workspace. Ordinary clone, fetch and pull do not transfer the source repository's .git/config. Product patch status is a dated September 1, 2026 snapshot unless a vendor advisory establishes otherwise.

UnratedAI role: AGAINST AIAssessment method

At a glance

Mechanism and trust boundary

  1. 01

    A project directory arrives with local Git metadata intact

    The attack requires attacker-controlled .git configuration to be present on disk, which can happen through an archive, shared/synced directory, copied workspace, nested repository or similar file transfer.

    Boundary: external project / developer workstation

  2. 02

    The coding agent gathers repository context automatically

    An affected agent invokes Git for status, diff or related context before or around the user's first explicit agent action.

    Boundary: workspace open or review / agent application

  3. 03

    Git evaluates a command-bearing local setting

    In the common disclosed path, index refresh consults core.fsmonitor in .git/config and starts the repository-selected helper.

    Boundary: repository metadata / Git subprocess

  4. 04

    The host command runs outside the model tool gate

    The command is spawned by application context gathering, so the model tool sandbox and approval layer may never observe or authorize it.

    Boundary: agent plumbing / developer host authority

  5. 05

    Developer-level assets become reachable

    The process runs as the user; the Goose advisory specifically notes inherited environment secrets and provider API keys as accessible impact.

    Boundary: developer process / credentials and local repositories

Timeline

  1. Jun 26, 2026
    Event type unspecified

    Claude Code core.fsmonitor path is reported

    Manifold says the finding was closed as a duplicate of a same-day report and later fixed by 2.1.196.

  2. Jul 7, 2026
    Event type unspecified

    Qwen Code finding is reported

    Alibaba SRC accepted the report; Manifold still reproduced it on 0.22.3 on September 1.

  3. Jul 8, 2026
    Event type unspecified

    Cursor finding is reported

    The report was closed as a duplicate of an earlier finding and was patched before publication.

  4. Jul 13, 2026
    Event type unspecified

    Goose finding is reported

    The Goose variant was acknowledged and later tracked as CVE-2026-72718.

  5. Jul 14, 2026
    Event type unspecified

    Grok Build finding is reported

    Manifold says it duplicated a July 1 report and remained reproducible on 1.0.13 on September 1.

  6. Jul 15, 2026
    Event type unspecified

    A second Claude Code review-path finding is reported

    This distinct Git configuration sink was closed as a duplicate of an internal ticket and remained reproducible on 2.1.252 on September 1.

  7. Jul 20, 2026
    Event type unspecified

    Hermes Agent and OpenAI Codex findings are reported

    Manifold says Codex was patched; Hermes remained unpatched at the September 1 retest and was assigned CVE-2026-71963 by VulnCheck.

  8. Jul 24, 2026
    Event type unspecified

    Goose publishes its advisory

    GHSA-r5pp-p5r8-466r identifies versions before 1.44.0 as affected and 1.44.0 as patched.

  9. Sep 1, 2026
    Event type unspecified

    Manifold publishes GitSpawn

    The disclosure reports eight findings across seven agents, with four findings still open at that dated snapshot.

Claims & evidence

CLM-GITSPAWN-DELIVERYThe core repository-delivery path requires the victim to receive a directory with its .git metadata intact; Manifold notes that ordinary clone, fetch and pull do not copy a remote repository's local .git/config.supported

Basis: reported finding

Link to claim
CLM-GITSPAWN-GOOSE-FIXGoose's maintainer advisory tracks its variant as CVE-2026-72718, affects versions before 1.44.0 and identifies 1.44.0 as patched.supported

Basis: reported finding

Link to claim
CLM-GITSPAWN-MECHANISMIn the documented core.fsmonitor path, an agent's automatic Git context-gathering command could cause Git to execute a helper command stored in the repository's own .git/config, outside the agent sandbox and without a tool-approval prompt.supported

Basis: reported finding

Link to claim
CLM-GITSPAWN-BEFORE-GATESThe researchers documented product paths where attacker code executed before the user's normal workspace-trust, model-interaction or approval boundary had taken effect.supported

Basis: reported finding

Link to claim
CLM-GITSPAWN-SEVEN-AGENTSManifold Security reported eight related findings across seven AI coding agents, including Claude Code, OpenAI Codex, Cursor, Goose, Qwen Code, Grok Build and Hermes Agent.supported

Basis: reported finding

Link to claim
CLM-GITSPAWN-GOOSE-SEVERITYThe Goose maintainers rate CVE-2026-72718 at 7.0 under CVSS v4 and classify it as CWE-94.supported

Basis: reported finding

Scope: This severity measurement is specific to the Goose variant, not a score for every GitSpawn finding.

Recorded measurement: 7 CVSS v4 base score · Goose GHSA vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Link to claim
CLM-GITSPAWN-STATUS-SNAPSHOTManifold's September 1 publication reported eight findings across seven agents; four findings were fixed and four were still unpatched at that publication snapshot.supported

Basis: reported finding

Scope: Status is tied to Manifold's September 1, 2026 retest/publication. Later version numbers without a vendor advisory or reproduction do not by themselves establish remediation.

Recorded measurement: 4 unpatched findings out of 8 disclosed findings · Manifold Security disclosure status table and September 1 retest

Link to claim
CLM-GITSPAWN-POTENTIAL-IMPACTFor the Goose variant, successful execution runs with the privileges of the user running Goose and inherits that user's environment, so environment secrets and provider API keys can be exposed.supported

Basis: reported finding

Scope: Potential technical impact described by the advisory; the source does not report realized theft from a malicious in-the-wild exploitation.

Link to claim

Implications

A coding agent can execute attacker-controlled host code before the model participates. Security reviews therefore need to include startup discovery, version-control helpers and other application-owned subprocesses, not only model tool calls. A workspace-trust prompt that appears after context gathering is not a boundary for work already performed.

Controls and mitigations

  • Update affected coding agents to vendor-fixed versions and verify product-specific advisories rather than assuming the class is fixed everywhere.
  • Prefer a fresh clone from a URL you selected over opening a received directory that already contains a .git directory.
  • Inspect or discard repository-local Git configuration before opening file-transferred workspaces in an AI coding agent.
  • Sanitize command-bearing Git configuration for every automatic context-gathering invocation, not only core.fsmonitor.
  • Move pre-model repository discovery behind the same workspace-trust boundary that governs explicit agent actions.
  • Run application-owned Git subprocesses under the same least-privilege and sandbox assumptions as model-initiated tools.
  • Limit ambient developer credentials and provider secrets available to coding-agent processes.

Unknowns and contradictions

  • The reviewed primary sources establish reproducible vulnerabilities, not malicious exploitation in the wild.
  • Vendor-confirmed current remediation status after September 1 remains unresolved for the Claude ultrareview path, Hermes Agent, Qwen Code and Grok Build.
  • Not every finding used core.fsmonitor; at least one distinct command-bearing Git configuration key was intentionally withheld while unpatched.
  • The prevalence of project handoffs that preserve attacker-controlled .git metadata is not measured by the scoped sources.

Sources and citation

EvidenceGitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and GrokEvidenceArbitrary command execution in goose CLI via goose review via git core.fsmonitor

Material revision history

  1. Sep 19, 2026 · Published version · first publication · revision 22
Record metadata

Canonical ID: CASE-2026-GITSPAWN · revision 22

Legacy date (semantics unspecified): 2026-09-01. This value is not treated as an occurrence or disclosure date.