CVE-2014-9938

What it actually does

The flaw fails to sanitize branch names when constructing the PS1 shell prompt variable via git-prompt.sh, permitting command injection that results in arbitrary code execution in the user's shell.

Why it matters to the business

Developers and teams risk compromise of workstations and source code when interacting with untrusted repositories, potentially enabling data exfiltration or lateral movement; low ongoing risk given the vulnerability's age and modest exploit probability.

How an attack unfolds

An attacker publishes a repository whose branch name embeds shell metacharacters and commands; a victim clones or checks out the repository while sourcing git-prompt.sh, causing the injected payload to execute automatically when the prompt renders.

How to fix it

Upgrade affected Git installations to version 1.9.3 or later; where packages are provided through distributions, apply the corresponding fixed OpenVPN package versions listed for Debian 11/12/13 and Ubuntu 14.04/16.04.

How to confirm the fix worked

Confirm Git is at 1.9.3 or newer, test that branch names containing command substitutions no longer execute when the prompt is displayed, and verify distribution package versions match the supplied fixed releases.

Typical attack path

1. Create a Git repository containing a branch name with embedded shell commands
2. Social-engineer a target into cloning or fetching from the repository
3. Trigger prompt refresh in an interactive shell that sources the vulnerable completion script
4. Execute attacker-controlled commands with the privileges of the victim's shell session

How to detect it

Review shell history, process execution logs, and any recorded prompt expansions for unexpected command invocations immediately after Git operations; inspect cloned repository metadata for suspicious branch names.

What your security team should do

• Prioritize patching development workstations and CI systems that use Git prompts
• Disable or replace git-prompt.sh in high-risk environments until upgrades are complete
• Monitor EPSS and exploit availability trends for any resurgence in interest