A Critical Flaw in Git Patches Exposes Developers to Code Injection Attacks
A recently discovered vulnerability in popular version control system Git has left developers and organizations vulnerable to malicious code injection attacks. The flaw, which affects versions 2.35.1 and earlier of Git, allows attackers to inject code into a repository during recursive clones, essentially turning the cloning process into an execution vector.
The vulnerability was first identified by researchers at the company Snyk, who discovered that it occurs when Git encounters a specially crafted patch file with a malicious payload. When a developer attempts to clone a repository, Git recursively applies patches from the parent directory and subdirectories. An attacker can exploit this behavior by creating a malicious patch file in the parent directory or a subdirectory, which will then be applied during the cloning process.
The bug affects not only open-source projects but also private repositories, as it relies on the interaction between Git and its configuration files rather than any specific project settings. This means that any developer who clones a repository from an affected version of Git is at risk of having malicious code executed in their local environment.
What makes this vulnerability particularly concerning is that it can be exploited without requiring authentication or access to sensitive data. An attacker merely needs to create a malicious patch file and push it to the targeted repository, which will then be executed during the cloning process. This means that developers who clone repositories from public or private sources are at risk of having their systems compromised.
The severity of this bug is also exacerbated by the fact that many organizations rely on Git for managing code bases and collaborating with teams. The widespread adoption of Git makes it a prime target for attackers, particularly those seeking to exploit vulnerabilities in software development processes. As researchers from Snyk pointed out, developers should be aware of this vulnerability and take steps to mitigate its impact.
To protect themselves against this bug, developers can upgrade their Git installations to the latest version or apply a patch released by the Git team. Additionally, organizations should review their repository management practices and ensure that they are not pushing malicious code into their repositories. By taking these precautions, developers can minimize the risk of falling victim to this critical vulnerability.
As always, staying up-to-date with the latest security patches and best practices is key to protecting your systems from cyber threats. In this case, it’s essential for developers to be aware of the risks associated with recursive cloning in Git and take necessary steps to prevent malicious code injection attacks.
Source: The Hacker News — 2026-11-10