GitSpawn Exposes Persistent Git Config Execution Risks in Coding Agents
Manifold Security has published GitSpawn, a report uncovering eight vulnerabilities across seven coding agents that allow arbitrary code execution simply by opening a received folder.
The attack leverages Git's core.fsmonitor configuration key stored in .git/config. This setting defines a command that Git automatically runs during index refreshes triggered by operations such as git status or git diff. Coding agents invoke these commands in the background immediately after opening a directory to build context, executing the payload before any user approval or prompt.
The researcher demonstrated the exploit by setting core.fsmonitor to a malicious script and confirming execution with a single git status command. Payloads ran even in the absence of any explicit user action beyond opening the folder.
Partial Patches Leave Broader Risks
Vendors responded with targeted fixes. Claude Code closed the core.fsmonitor vector in version 2.1.196, and similar patches were applied to Codex, Cursor, and Goose. However, these mitigations only prevent the agent from invoking Git with dangerous configuration values. Manual execution of git status or integration with build scripts, editors, and CI systems still triggers the payload.
Additional issues compound the problem. Manifold Security reported a second bypass path in Claude Code that remained open on version 2.1.252. Agents including Qwen Code, Grok Build, and Hermes Agent stayed unpatched as of the report date. A separate vector involving nested bare repositories was assigned CVE-2026-45033 and affected GitHub Copilot CLI until version 1.0.43.
The class of vulnerability is not new. VS Code addressed similar risks in 2021 through workspace trust prompts, yet the arrival of autonomous coding agents effectively reset those protections.
Stroq Tool for Pre-Opening Inspection
To address the gap, the researcher released Stroq, an open-source Apache-2.0 tool that scans repositories for dangerous settings before they are accessed. The command checks .git/config for executable values, .gitattributes, .husky hooks, postinstall scripts, and nested bare repositories.
Environment variable overrides can also neutralize the vectors at runtime by forcing core.fsmonitor to false and disabling automatic bare repository discovery. The tool is intended for use in pre-commit hooks and CI pipelines.
Related articles
Unbound 1.26.1 Patches Critical DNSSEC Validator Flaw CVE-2026-81642 Enabling Remote Code Execution
NLnet Labs has released Unbound 1.26.1 to address CVE-2026-81642, a critical vulnerability in the DNSSEC validator that can cause service crashes and potential remote code execution. The flaw affects all versions up to and including 1.26.0 and is triggered when validating a malicious DNS zone. It resides in the handling of DNSKEY records, where a buffer overflow can occur during DNS response processing. The vulnerability carries a CVSS 4.0 score of 9.1 with a network attack vector, no privileges required, and no user interaction needed. Exploitation requires an attacker to control a malicious DNS zone that the resolver queries, which can lead to denial of service or RCE in the worst case. The update also includes fixes for eight additional security issues, including CVE-2026-82717 and CVE-2026-81634, both involving heap corruption.
BIND DNS Servers Receive Patches for 14 Vulnerabilities Including High-Severity DoS Flaws
The Internet Systems Consortium has released BIND 9 updates that address 14 vulnerabilities across multiple versions of the widely used DNS server software. Seven of the issues received a CVSS score of 7.5 and were rated high severity, while the remaining seven scored between 5.3 and 6.5. The most critical flaw allows an unauthenticated attacker to crash the named process with a single malformed SIG(0) request over DNS over HTTPS. Additional vulnerabilities enable cache poisoning through forged NXDOMAIN responses, downgraded secure delegations, and acceptance of unsigned answers, as well as resource exhaustion via uncontrolled cache growth and excessive CPU consumption. Affected releases span BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25. No workarounds exist, making immediate upgrades to versions 9.20.29, 9.21.26, or 9.20.29-S1 the only mitigation. The ISC reports no known exploitation in the wild and none of the flaws appear in CISA’s Known Exploited Vulnerabilities catalog.
Cisco Patches 29 Vulnerabilities in Secure Firewall ASA, FTD and FMC Products
Cisco Systems has disclosed multiple vulnerabilities affecting its Cisco Secure Firewall product line and released corresponding security updates. The advisory covers 14 security bulletins addressing 29 CVEs across Adaptive Security Appliance (ASA), Threat Defense (FTD), and Management Center (FMC) software. Five of the advisories are rated Critical, covering 18 CVEs that include remote code execution without authentication and privilege escalation to administrator level. Several issues have already been confirmed as exploited in the wild. The company also consolidated related weaknesses under single CVE identifiers where appropriate and provided CVSS v3.1 base scores ranging up to 9.9. Affected products include the Secure Firewall 3100 and 4200 Series along with multiple software hardening releases issued on 16 September 2026.
pgAdmin 4 Database Management Tool Patches Multiple Vulnerabilities in Version 9.18
The development team behind pgAdmin 4, the popular management tool for PostgreSQL databases, has released version 9.18 to address multiple security issues. The update, published on September 17, 2026, includes fixes for four CVEs along with 29 total changes covering new features and bug resolutions. One vulnerability, tracked as CVE-2026-86863, stems from insufficient web server authentication that trusts external HTTP headers, enabling attackers to bypass login and impersonate administrators without passwords. A second issue, CVE-2026-86864, allows command injection through the backup feature when database names are passed as arguments, potentially leading to unauthorized file writes or exfiltration of connection passwords. The update is available now from the official pgAdmin repository.