GitSpawn: A Single Flaw Lets Untrusted Repos Run Code in Claude Code, Codex, Cursor, and Grok - Manifold Security

What it is

"GitSpawn" (Manifold Security, disclosed by Francisco Rosales) is a vulnerability class in which AI coding agents run git context-gathering commands at startup without stripping the target repository's own .git/config. Because git refreshes its index before commands like git status/git diff, a hostile repo can name a command in an index-refresh config sink (e.g. core.fsmonitor) and get arbitrary code execution as the developer, outside the sandbox, before any prompt. Affected: Claude Code, Goose, Hermes, Qwen Code, Grok Build, and (per a 1 Sept 2026 update) OpenAI Codex and Cursor.

How it works

core.fsmonitor is a legitimate perf setting: git runs the named helper program during an index refresh. Git reads it from the repo's .git/config, so any index-refreshing command the agent spawns executes that program on the host with the user's privileges, before the workspace-trust dialog or authentication. The code runs as a subprocess of the agent's own code, so the permission model never sees it. One Claude Code finding uses a different config key of the same kind (deliberately unnamed while unpatched), not core.fsmonitor.

Delivery matters: cloning, fetch, and pull are safe — git never transports this config. The repo must arrive as files with .git/ already inside: a zip, shared drive, sync folder, or USB stick. All PoCs used a .zip.

Preconditions / Affected

Per-agent status (all re-confirmed on current releases):

• Goose — goose review. Affected 1.41.0, fixed 1.44.0. CVE-2026-72718 (7.0).
• Claude Code (fsmonitor) — git status at startup. Confirmed 2.1.193, fixed by 2.1.196.
• Claude Code (ultrareview) — different config key. Reported on 2.1.210, still unpatched on 2.1.252 (1 Sept).
• Hermes — git status on first message. CVE-2026-71963 (assigned by VulnCheck, not vendor). Confirmed 0.21.0, unpatched; GHSA never triaged.
• Qwen Code — git status at startup, before auth. Confirmed 0.22.3, unpatched.
• Grok Build — fires on first keystroke. Confirmed 1.0.13, unpatched.
• Codex / Cursor — reported as duplicates, since patched.

Four of eight findings remain live at publication.

What to do

If you receive a repo as files, inspect .git/config before opening the directory with an agent — any setting naming a program can run it.

If you ship an agent, sanitize the git config on background context-gathering calls:

git -c core.fsmonitor=false status

Caveats

Manifold deliberately withheld a ready-to-use PoC repo and left the second Claude Code config key unnamed while unpatched. Five of their reports came back as duplicates of independent researchers' filings (one the same day), so this is being discovered from multiple directions.