GitSpawn Exposes Persistent Git Config Execution Risks in Coding Agents
Manifold Security has published GitSpawn, a report uncovering eight vulnerabilities across seven coding agents that allow arbitrary code execution simply by opening a received folder.
The attack leverages Git's core.fsmonitor configuration key stored in .git/config. This setting defines a command that Git automatically runs during index refreshes triggered by operations such as git status or git diff. Coding agents invoke these commands in the background immediately after opening a directory to build context, executing the payload before any user approval or prompt.
The researcher demonstrated the exploit by setting core.fsmonitor to a malicious script and confirming execution with a single git status command. Payloads ran even in the absence of any explicit user action beyond opening the folder.
Partial Patches Leave Broader Risks
Vendors responded with targeted fixes. Claude Code closed the core.fsmonitor vector in version 2.1.196, and similar patches were applied to Codex, Cursor, and Goose. However, these mitigations only prevent the agent from invoking Git with dangerous configuration values. Manual execution of git status or integration with build scripts, editors, and CI systems still triggers the payload.
Additional issues compound the problem. Manifold Security reported a second bypass path in Claude Code that remained open on version 2.1.252. Agents including Qwen Code, Grok Build, and Hermes Agent stayed unpatched as of the report date. A separate vector involving nested bare repositories was assigned CVE-2026-45033 and affected GitHub Copilot CLI until version 1.0.43.
The class of vulnerability is not new. VS Code addressed similar risks in 2021 through workspace trust prompts, yet the arrival of autonomous coding agents effectively reset those protections.
Stroq Tool for Pre-Opening Inspection
To address the gap, the researcher released Stroq, an open-source Apache-2.0 tool that scans repositories for dangerous settings before they are accessed. The command checks .git/config for executable values, .gitattributes, .husky hooks, postinstall scripts, and nested bare repositories.
Environment variable overrides can also neutralize the vectors at runtime by forcing core.fsmonitor to false and disabling automatic bare repository discovery. The tool is intended for use in pre-commit hooks and CI pipelines.
Related articles
Critical CVE-2026-111497 Out-of-Bounds Write Flaw in Google Brotli Decoder Impacts Broad Range of Environments
A severe vulnerability has been identified in the Google-developed Brotli decoder used for decompressing data in web communications and other applications. The flaw, tracked as CVE-2026-111497, allows out-of-bounds writes when processing specially crafted compressed data, potentially enabling arbitrary code execution, information disclosure, or denial of service. It carries a CVSS v4.0 base score of 9.2 and is rated Critical. Google has released patched versions 1.2.1, 1.1.1, and 1.0.10 of the library. Node.js incorporated the fix in its updates, while Microsoft issued an out-of-band patch for .NET on October 25, 2026, to address the issue. The vulnerability affects any environment relying on the Brotli C implementation for data decompression.
Critical Code Injection Flaw in Okta Access Gateway Allows Authenticated Command Execution
Okta disclosed CVE-2026-115547, a critical code injection vulnerability in the administrative console of Okta Access Gateway. An authenticated administrator can execute arbitrary commands on the underlying system using the privileges of the gateway service account. The flaw received a CVSS 3.1 score of 9.1 and stems from insufficient input validation when processing configuration values in a specific format. Affected appliances running versions prior to 2026.10.2 must be updated, as no workaround is provided. The same disclosure day also included CVE-2026-115546 for authentication source verification and two PHP execution issues (CVE-2026-109618, CVE-2026-109619) previously seen in Palo Alto PAN-OS. Exploitation requires administrative console access and no in-the-wild attacks have been reported.
GitLab Discloses 12-Year-Old CVSS 10.0 Vulnerability Enabling Unauthenticated Remote Code Execution
GitLab has published a critical security advisory for CVE-2026-110264, a CVSS 10.0 flaw that permits unauthenticated remote code execution on both Community and Enterprise self-hosted instances. The vulnerability has existed in the codebase since 2014 and affects every version up to the latest release prior to the October 2026 patch. Exploitation requires no credentials or special conditions, allowing attackers to run arbitrary commands, exfiltrate source code, deploy backdoors, or move laterally. The issue remained undetected through multiple code iterations, security audits, and version updates due to its hidden trigger conditions within the large, complex application. Organizations are urged to immediately verify their version, review access logs for anomalies, and apply the official fix, while temporary mitigations include network restrictions and enhanced monitoring.
Google Brotli Decoder Vulnerability CVE-2026-111497 Enables Remote Code Execution in Node.js, Python, Bun and Envoy
A critical out-of-bounds write flaw in Google's Brotli decoder (CVE-2026-111497) affects multiple widely used platforms including Node.js, Python, Bun and Envoy. Imperva researchers demonstrated reliable remote code execution on official Node.js 24.22.0 builds for Linux arm64, naming the exploit Node2Shell. The vulnerability allows crafted Brotli-compressed data to corrupt memory, leading to crashes, information leaks or arbitrary code execution. Affected versions include Node.js releases below 22.23.4, 24.22.1 and 26.12.1, plus all versions of the Python brotli and brotlicffi packages. Patches have been issued for Node.js, while other projects await updates; no in-the-wild exploitation has been observed yet. The incident highlights recurring supply-chain risks where a single foundational library impacts thousands of downstream applications.