A flaw was found in git which allows arbitrary code to be executed when running 'git clone --recurse-submodules (or the deprecated 'git clone --recursive' synonym). A malicious repository can include a .gitmodules submodule config file which points outside of the repository. When git clones such a repository it can be tricked into running hooks within the cloned submodule, which is under the control of the attacker.

References: https://public-inbox.org/git/xmqqy3g2flb6.fsf@gitster-ct.c.googlers.com/ https://www.edwardthomson.com/blog/upgradinggitforcve201811235.html https://news.ycombinator.com/item?id=17181238

Git before versions 2.13.7, 2.14.4, 2.15.2, 2.16.4 and 2.17.1 performs path sanity-checks in isntfsdotgit():path.c that can be fooled into reading arbitrary memory.

Upstream announcement: https://marc.info/?l=git&m=152761328506724&w=2