Git credential helper vulnerability announced
Learn more about the security vulnerabilities affecting Git 2.26 and older.
Today, the Git project released new versions to address a security vulnerability in the credential helper mechanism that affects versions 2.26 and older.
These updates address an issue where a malformed remote URL (for example, from a git clone, either directly, or as part of a submodule) can inject arbitrary data into the credential helper protocol stream. If you use a credential helper[1], this can be used to exfiltrate your credentials for one repository to an arbitrary destination.
Upgrade to the latest Git version
The most effective way to protect against this vulnerability is to upgrade to 2.26.1. If you can’t update immediately, reduce your risk with the following:
- Avoid running
git clonewith--recurse-submodulesagainst untrusted repositories - Avoid using the credential helper by only cloning publicly available repositories
GitHub has also taken proactive action in order to protect against these attacks. Specifically, we:
- Deployed a change to prevent malicious
.gitmodulesfiles from being pushed to GitHub.com - Scheduled a GitHub Desktop release for later today that prevents exploiting this vulnerability
- Patched recent releases of GitHub Enterprise[2] to prevent this vulnerability in Pages
Credit for finding these vulnerabilities goes to Felix Wilhelm of Google Project Zero.
[1]: Many Git users have credential helpers configured to use credentials from their operating system’s keychain.
[2]: These fixes were included in the supported release series, specifically: 2.17.21, 2.18.15, 2.19.10, and 2.20.4. A subsequent release next week will ship the same patches we use on GitHub.com to prevent malicious .gitmodules from being pushed to your installation.
Tags:
Written by
Related posts
From karaoke terminals to AI résumés: The winners of GitHub’s For the Love of Code challenge
This summer, we invited devs to participate in our hackathon for joyful, ridiculous, and wildly creative projects. Here are the winners of For the Love of Code!
Inside the breach that broke the internet: The untold story of Log4Shell
Log4Shell proved that open source security isn’t guaranteed and isn’t just a code problem. It’s about supporting, enabling, and empowering the people behind the projects that build our digital infrastructure.
Accelerate developer productivity with these 9 open source AI and MCP projects
GitHub Copilot and VS Code teams, along with the Microsoft Open Source Program Office (OSPO), sponsored these nine open source MCP projects that provide new frameworks, tools, and assistants to unlock AI-native workflows, agentic tooling, and innovation.