A git-config flaw runs attacker code before your agent asks permission

Rosales, an independent security researcher, found that a repository's own .git/config file can name a program under the core.fsmonitor setting, and that program runs automatically whenever git's housekeeping commands fire, commands like git status or git diff that coding agents and IDEs issue on their own the moment a folder opens. The program runs on the host, with the user's own permissions, unsandboxed, and often before any workspace-trust prompt or authentication step. Cloning is not required: the exploit travels the moment a .git folder arrives as ordinary files, in a zip, a shared drive, or a USB stick, the way colleagues and consultants routinely hand off projects.

Rosales confirmed the flaw across seven agents. Claude Code had two separate sinks: one patched in version 2.1.196, a second, on a different configuration key, still unpatched as of 2.1.252. Goose was patched under CVE-2026-72718. Qwen Code's issue was accepted by Alibaba's security response center but remains unpatched. Grok Build remains unpatched, closed by xAI as a duplicate of an earlier report marked informative. OpenAI Codex and Cursor were both patched, filed as duplicates of separate researchers' reports. Hermes remains unpatched after six contact attempts across five channels, and carries its own CVE, 2026-71963.

Why it matters: Treat an unfamiliar repository's git configuration as untrusted input before opening it in an agent-enabled editor. Because ordinary files can deliver this exploit without a clone, it defeats guardrails several vendors built around a network-based delivery path.