4 ms·
> any competently set up shell PS1 will tell you that I certainly hope your shell is not running `git` commands automatically for you. If so, that is a RCE vul
by tom_alexander 5mo ago
> any competently set up shell PS1 will tell you that
I certainly hope your shell is not running `git` commands automatically for you. If so, that is a RCE vulnerability since you could extract a tarball/zip that you don't expect to be a git repository but it contains a `.git` folder with a `fsmonitor` configured to execute a malicious script: https://github.com/califio/publications/blob/main/MADBugs/vim-vs-emacs-vs-claude/Emacs.md https://github.com/califio/publications/blob/main/MADBugs/vi...
- fragmede 5mo agoMight want to let git know. It's been a part of the git source code since 2006. If there were an RCE vulnerability from using __git_ps1, one would hope it would have been found by now! https://github.com/git/git/blob/master/contrib/completion/git-prompt.sh https://github.com/git/git/blob/master/contrib/completion/gi...
- tom_alexander 5mo agoI was able to reproduce it using that script in my PS1 when `GIT_PS1_SHOWUNTRACKEDFILES=1` which triggers a call to `git ls-files`. Without that, it seems to be just calling `git rev-parse` which does not execute fsmonitor. I was also able to reproduce it with `GIT_PS1_SHOWDIRTYSTATE=1` which invokes `git diff`. As far as I am aware, this has been brought to the attention of the git maintainers years ago: https://github.com/justinsteven/advisories/blob/main/2022_git_buried_bare_repos_and_fsmonitor_various_abuses.md#timeline https://github.com/justinsteven/advisories/blob/main/2022_gi...