Vulnerability record · CVE-2017-1000117 · published 5 October 2017
CVE-2017-1000117: Git ssh:// URL handling allows arbitrary command execution
Git Scm · Git
Git mishandles crafted ssh:// URLs, allowing a malicious third party to cause arbitrary programs on the victim's machine to be executed. The URL can be embedded in the .gitmodules file of a malicious project, so a victim who runs git clone --recurse-submodules triggers the flaw. This matters because cloning an untrusted repository can lead to full code execution on the developer's workstation.
Description
A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trigger the vulnerability.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with user interaction required, very high EPSS and a public exploit make this a serious risk for developer and build environments.
What it is
Git mishandles crafted ssh:// URLs, allowing a malicious third party to cause arbitrary programs on the victim's machine to be executed. The URL can be embedded in the .gitmodules file of a malicious project, so a victim who runs git clone --recurse-submodules triggers the flaw. This matters because cloning an untrusted repository can lead to full code execution on the developer's workstation.
Impact
An attacker gains arbitrary command execution in the context of the user running Git, which can lead to credential theft, source code tampering, and further compromise of the developer host.
Attack surface
Reached over the network via a crafted ssh:// URL delivered in a repository's .gitmodules file; no authentication is required, but user interaction is needed because the victim must clone the project with submodules recursed.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.778, 99.5th percentile) and a public Exploit-DB entry (42599) exists, indicating known public exploitation methods.
What to do
- Upgrade Git to a version containing the fix for CVE-2017-1000117; apply the vendor patches referenced in the Red Hat, Debian, Gentoo and Apple advisories.
- Avoid running git clone --recurse-submodules on untrusted repositories until all Git clients are patched.
- Inspect .gitmodules files for unexpected ssh:// URLs before recursing submodules.
- Restrict or monitor outbound SSH from developer and build hosts to limit post-exploitation reach.
- Enforce use of trusted repository sources and review third-party projects before cloning.
Detection
- Monitor process creation for git clone --recurse-submodules followed by unexpected child processes such as shells or scripting interpreters.
- Alert on .gitmodules content containing ssh:// URLs, especially with unusual host or path values.
- Review Git client versions across developer and CI/CD hosts for unpatched instances.
- Correlate outbound SSH connections from build or developer systems with recent repository clone activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-1000117 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-1000117), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
