CVE-2018-17456: Git recursive clone argument injection enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no privileges and public exploit code, combined with Git's ubiquity in development and build environments, makes this a critical patching priority despite its absence from KEV.

What it is

Git versions before the fixed releases mishandle a .gitmodules URL field that begins with a '-' character during recursive 'git clone' of a superproject. Because the URL is passed to the underlying git command without proper argument separation, an attacker-controlled repository can inject command-line options and achieve code execution. The flaw affects a core developer tool used across Linux distributions and enterprise platforms, so exposure is broad wherever untrusted repositories are cloned.

Impact

An attacker who controls a repository the victim clones recursively can execute arbitrary code with the victim's privileges, leading to full compromise of confidentiality, integrity and availability on the affected host.

Attack surface

Reached over the network when a user or automated system runs a recursive clone of an attacker-supplied superproject; no authentication is required, but the victim must initiate the clone, so some user or process interaction is needed. The CVSS vector reflects network reachability with no privileges and no UI, though in practice the clone action is the trigger.

Exploitation

EPSS is very high (0.97356, 99.894th percentile) and public exploit code exists in Exploit-DB, but the CVE is not listed in CISA KEV and no ransomware groups are documented using it.

What to do

• Upgrade Git to 2.14.5, 2.15.3, 2.16.5, 2.17.2, 2.18.1, 2.19.1 or later, and apply the vendor errata for Red Hat, Ubuntu and Debian packages.
• Avoid recursive cloning of untrusted or unvetted repositories; review .gitmodules before cloning submodules.
• Reject or sanitize .gitmodules URL values that begin with a '-' character in repository intake and CI pipelines.
• Restrict outbound network access and execution privileges for build and CI systems that perform automated clones.
• Monitor Git client versions across developer and build fleets and enforce a minimum patched version.

Detection

• Search Git server and CI logs for recursive clone operations against repositories containing .gitmodules entries whose URL begins with '-'.
• Alert on unexpected child processes spawned by git clone or git submodule update on developer and build hosts.
• Scan checked-out repositories and CI workspaces for .gitmodules files with leading-dash URL fields.
• Track Git client version inventory to identify hosts still running vulnerable releases.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.