GitSpawn Exposes Persistent Git Config Execution Risks in Coding Agents
Manifold Security has published GitSpawn, a report uncovering eight vulnerabilities across seven coding agents that allow arbitrary code execution simply by opening a received folder.
The attack leverages Git's core.fsmonitor configuration key stored in .git/config. This setting defines a command that Git automatically runs during index refreshes triggered by operations such as git status or git diff. Coding agents invoke these commands in the background immediately after opening a directory to build context, executing the payload before any user approval or prompt.
The researcher demonstrated the exploit by setting core.fsmonitor to a malicious script and confirming execution with a single git status command. Payloads ran even in the absence of any explicit user action beyond opening the folder.
Partial Patches Leave Broader Risks
Vendors responded with targeted fixes. Claude Code closed the core.fsmonitor vector in version 2.1.196, and similar patches were applied to Codex, Cursor, and Goose. However, these mitigations only prevent the agent from invoking Git with dangerous configuration values. Manual execution of git status or integration with build scripts, editors, and CI systems still triggers the payload.
Additional issues compound the problem. Manifold Security reported a second bypass path in Claude Code that remained open on version 2.1.252. Agents including Qwen Code, Grok Build, and Hermes Agent stayed unpatched as of the report date. A separate vector involving nested bare repositories was assigned CVE-2026-45033 and affected GitHub Copilot CLI until version 1.0.43.
The class of vulnerability is not new. VS Code addressed similar risks in 2021 through workspace trust prompts, yet the arrival of autonomous coding agents effectively reset those protections.
Stroq Tool for Pre-Opening Inspection
To address the gap, the researcher released Stroq, an open-source Apache-2.0 tool that scans repositories for dangerous settings before they are accessed. The command checks .git/config for executable values, .gitattributes, .husky hooks, postinstall scripts, and nested bare repositories.
Environment variable overrides can also neutralize the vectors at runtime by forcing core.fsmonitor to false and disabling automatic bare repository discovery. The tool is intended for use in pre-commit hooks and CI pipelines.
Related articles
Critical Unauthenticated File Upload Flaw in WooCommerce Wholesale Lead Capture Enables Active PHP Web Shell Attacks
A critical vulnerability tracked as CVE-2026-27540 affects WooCommerce Wholesale Lead Capture versions 2.0.3.1 and earlier, allowing unauthenticated attackers to upload arbitrary files including PHP web shells. The flaw resides in the wwlc_file_upload_handler AJAX action, where the file extension allowlist can be manipulated through the file_settings parameter to accept .php files. Exploitation has been observed in the wild with more than 100,000 blocked attempts since June 2026, including sustained campaigns from repeat IP addresses. The developer released version 2.0.3.2 on 20 February 2026 to address the issue, yet many sites remain unpatched. Organizations are advised to update immediately, audit wp-content/uploads for unexpected PHP files, and monitor admin-ajax.php requests for suspicious activity. In confirmed compromise cases, full remediation requires credential rotation and restoration from verified backups.
AWS Systems Manager Agent Flaw Allows Bypass of Port Forwarding Restrictions
Amazon has fixed a vulnerability in the AWS Systems Manager agent that permits an authenticated attacker to bypass restrictions on port forwarding sessions. The issue, tracked as CVE-2026-89049, stems from inadequate validation of equivalent representations of blocked link-local addresses. As a result, attackers can reach the EC2 instance metadata service at 169.254.169.254 and obtain temporary credentials tied to the instance's IAM role. Affected versions are those prior to 3.3.4851.0, with the fix included in that release and all subsequent versions. AWS recommends reviewing custom builds of the agent, restricting access to the AWS-StartPortForwardingSessionToRemoteHost document, auditing Session Manager activity, and applying least-privilege principles to IAM roles.
Vulnerability Management in Atypical Environments: ICS, Networks, IoT, Mobile, Hardware, and ML Systems
Vulnerability management follows the same core process across environments—identify assets, scan, assess risk, prioritize, remediate, and verify—but each domain introduces critical constraints. In industrial control systems, scanning must avoid disrupting physical processes, requiring audit-mode authenticated scans, digital twins for testing, and strict change windows. Network devices frequently suffer from poor segmentation, default SNMP community strings, and exposed management interfaces that enable traffic redirection or configuration tampering. IoT ecosystems remain plagued by default credentials, as demonstrated by the Mirai botnet that took down major DNS infrastructure in 2016, while modern botnets like Reaper and VPNFilter exploit unpatched firmware at massive scale. Machine learning systems face novel threats including prompt injection, prompt leaking, and jailbreaking that can bypass safety controls or exfiltrate training data. Mobile platforms suffer from extreme fragmentation that prevents timely patching of vulnerabilities such as Stagefright, Pegasus, and BlueBorne. Hardware-level flaws like Spectre, Meltdown, and BadUSB demonstrate that even firmware and silicon require coordinated microcode, OS, and application updates.
Google Issues Chrome 153 Security Update Addressing 42 Vulnerabilities Including Three Critical Flaws
Google has released a major security update for its Chrome browser version 153, fixing a total of 42 vulnerabilities. The update includes three critical-severity issues that could allow attackers to execute arbitrary code or cause memory corruption. Patches are now available for Windows, macOS, and Linux platforms, with versions 153.0.8010.48 and 153.0.8010.47. Among the critical fixes are out-of-bounds read in WebGL, use-after-free in Internals, and another use-after-free in Workers. The release also resolves 28 high-severity flaws affecting the V8 JavaScript engine, ServiceWorker, Skia, DOM, PDF, and other components. Medium and low severity issues were addressed as well, bringing the total to 42 vulnerabilities resolved.