The Git Project addressed a critical remote code execution vulnerability

Reference: Advisory #2018-026
Version: 1.0
Affected software: Git 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1 and earlier releases
Type: Remote code execution



The vulnerability allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.


Git 2.19.1 has been released with a fix that addresses a vulnerability in Git that can cause arbitrary code to be executed when a user clones a malicious repository.

Recommend action

In order to be protected from the vulnerability, we recommend all users to update GitHub Desktop, Atom, their command-line version of Git, and any other application that may include an embedded version of Git.
Until the update, it is also recommended to avoid submodules from untrusted repositories.