Git fixes code execution bug in recursive clones.
Git fixed a flaw that allowed a malicious repository to trigger code execution during recursive clone operations. The issue affects workflows where submodules are automatically extracted, turning a normal key action into an execution path. Details were detailed in a Git patch advisory posted on November 10.
The security impact is significant because recursive cloning is common in CI/CD, pipeline building, and developer onboarding. A repository-level exploitation path lowers the barrier to initial access and makes it harder to maintain assumptions of trust in the supply chain around submodules.
Open sources - closed narratives.