Rules / CFG121

CFG121 committed git metadata makes an agent's git call run a command or fetch from an impostor

Severity: error (a bare repository whose config runs a command) · warn (any other bare repository, an unencrypted or lookalike submodule URL) OWASP: LLM04:2026 – Supply Chain Agents: claude-code, cline, codex, continue, copilot, cursor, devin, devin-desktop, gemini-cli, grok, kimi-code, opencode, qwen-code, roo-code, vscode, zed

What cfgaudit checks

Coding agents run git on their own: git status after an edit, git submodule update after a checkout. Two kinds of committed git metadata turn those calls into code execution or a fetch from someone else (#994).

A nested bare repository. A committed directory with HEAD and config files next to objects/ and refs/ directories is a bare repository. When git runs inside it, or discovers it, git reads its config, so a core.fsmonitor there runs on the next git status (CVE-2026-45033, CVE-2026-72718). cfgaudit walks the scanned directory (not .git, node_modules, vendor, target, dist, build or virtual environments, at most eight levels deep) and reports:

• error when the config sets a key git runs as a command: core.fsmonitor (other than true/false), core.hooksPath, core.sshCommand, core.pager, core.editor, core.askPass, diff.external, sequence.editor, credential.helper, a filter.<name>.clean/smudge/process, uploadpack.packObjectsHook;
• warn for any other bare repository, since a later change to its config runs the same way.

A submodule URL in .gitmodules that git fetches without encryption (http://, git://), or whose host imitates a forge: within two edits of github.com, gitlab.com, bitbucket.org or codeberg.org but not that host or a subdomain of it, a forge name followed by another domain (github.com.evil.io), or a non-ASCII or punycode host (CVE-2026-47284). Self-hosted forges (gitlab.company.com) and relative URLs are not reported. These are warn.

On 255 .gitmodules files from public repositories, CFG121 reported 9 unencrypted URLs (http://github.com/..., git://github.com/...) and no lookalike host.

Trigger example

A committed fixtures/evil.git/ with HEAD, objects/, refs/ and this config:

[core]
    bare = true
    fsmonitor = touch /tmp/marker

[submodule "lib"]
    path = lib
    url = https://githu6.com/org/lib.git

Safe alternative

Keep git fixtures as an archive the tests unpack into a temporary directory, not as a bare repository in the working tree. Point submodules at the real host over HTTPS.

References

• CVE-2026-45033, CVE-2026-72718 (nested bare repositories), CVE-2026-47284 (lookalike submodule host)
• git-config: core.fsmonitor

Documentation for cfgaudit 1.20.0. Source of this page · Rule implementation