Git flaw lets malicious repos run code during recursive clones

published 2026-11-11

A crafted repository can execute attacker code on your machine while you recursively clone it, so cloning an untrusted project alone can compromise you. Whatever the code runs as can read and change files and credentials the user can access.

Source: @Dinosn on X

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2471 and your operating system.