Vulnerability in Git, Mercurial allows for arbitrary code execution on OSX, Windows; affects Visual Studio, Github client app, among others
Context & Ripple Effects
This is a disclosure from Junio C Hamano's mailing list about a flaw hitting both major open-source version control systems at once — meaning every GUI that bundles Git or Mercurial inherits the bug. The named victims are Microsoft's [[a:|Visual Studio]] and the GitHub desktop client on OSX and Windows.
The arc here is the version-control client as an attack surface: the same recursive-clone vector reappears four years later when Git patches two flaws including another malicious-repo code execution bug, showing the class wasn't fixed once but keeps resurfacing.
First-order effects
- Anyone cloning untrusted repos with Visual Studio, the GitHub client app, or stock Git/Mercurial on OSX or Windows is exposed to arbitrary code execution until they update their bundled binaries.
- Downstream packagers and IDE vendors who ship embedded Git/Mercurial copies must rebuild and push patches through their own release channels, not just point users at upstream fixes.
Second-order effects
- GitHub and Microsoft, whose flagship developer tools bundle the affected libraries, face pressure to treat upstream VCS security releases as urgent dependencies — the desktop client is only as safe as the Git inside it.
- Hosting platforms gain a new argument for controlling the entire toolchain: the 2018 recurrence of the malicious-repo execution flaw shows patch-on-disclosure alone doesn't close the class, pushing platforms toward sandboxed or server-side operations.
Third-order effects
- If repository-cloning stays a recurring execution vector — as the 2018 patch cycle confirms — the industry trend is toward formalized disclosure infrastructure like GitHub's private vulnerability reporting, which later gave researchers a confidential channel to maintainers rather than public mailing-list advisories.
- Trust boundaries shift from 'the repo content' to 'the tooling that touches it': package managers, IDEs, and clients all become part of the software supply chain that attackers probe, a pattern also visible in researchers demonstrating how easily they obtained commit access to widely-used repositories like Homebrew.
The trend: Version control is consolidating from a command-line utility into a platform-controlled toolchain, where each upstream flaw forces coordinated patches across every vendor that embeds it.