Security Holes in Git

on YouTube ↗54m

" summary

Specific exploits show how Git lets attackers write into the repository metadata and run code: case-insensitive and Unicode filename tricks let commits create files in the .git area (overwriting object files to poison the object DB), 8.3 and HFS+ normalization allow hidden hooks to appear and execute, and a recursive-clone submodule with a malicious URL or path causes SSH to run arbitrary commands (demonstrated via CVE-2014-9390 and CVE-2018-11235). Tools used in response include Valgrind, Coverity and libgit2 patches.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 0:37Edward Thomson
3. 3:13Top 3 reasons to write an application in C
4. 9:24Desktop Usage
5. 51:15Protect Yourself: Stay Patched

" related talks

• 28mOn Omitting Commits and Committing Omissions: Preventing Git Metadata...Justin Cappos, Santiago Torres-Arias, Anil Kumar Ammula, Reza Curtmola · USENIX Security '16
• 36mGithub Actions Security LandscapeRonen Slavin, Alex Ilgayev · SupplyChainSecurityCon at Open Source Summit North America 2022
• 23mBreaking the Build: How Attackers Abuse GitHub ActionsJonathan Evans · CVE/FIRST VulnCon 2025
• 30mHidden Vulnerabilities in Open SourceShaul Ben Hai, Sharon Benzeev · Global Security Vulnerability Summit @ Open Source Summit North America 2022
• 01h 02mPrompt-Jacking: The Rise of a New Supply Chain RiskKasimir Schulz, Kenneth Yeung · NDC Toronto 2026
• 13mFive Ways to Break a Git RepositoryEdward Thomson · NDC Oslo 2019
• 28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System TakeoversSuyash Nalawade · DevConf.US 2025
• 39mWhat Have We Found in Git Repos?Marta Rybczynska · Open Source Summit Europe 2025