CVE-2015-7545

What it actually does

The vulnerability allows remote attackers to execute arbitrary code because git-remote-ext and other remote helper programs fail to restrict permitted protocols when processing URLs referenced in .gitmodules files or submodule configurations.

Why it matters to the business

Organizations using affected Git versions face the risk of unauthorized code execution on developer or build systems during routine operations like cloning repositories with submodules, potentially leading to supply chain compromise, data theft, or deployment of persistent malware.

How an attack unfolds

An attacker creates or modifies a repository containing a .gitmodules file that references a submodule URL using a protocol handled by git-remote-ext, such as a command-injection capable scheme; when a victim clones or updates the repository with submodules enabled, the helper executes attacker-controlled commands without protocol validation.

How to fix it

Upgrade Git to version 2.3.10 or newer, 2.4.10 or newer, 2.5.4 or newer, or 2.6.1 or newer depending on the release line in use; disable submodule recursion where operationally feasible until patches are applied.

How to confirm the fix worked

Verify installed Git version meets or exceeds the fixed releases listed in the advisory; audit .gitmodules files across repositories for non-standard protocol schemes and test clone operations in an isolated environment.

Typical attack path

1. Identify or publish a Git repository containing a malicious .gitmodules entry
2. Embed a submodule URL that triggers an unrestricted remote helper protocol
3. Wait for or lure a victim into performing git clone --recurse-submodules or submodule update
4. Achieve arbitrary command execution on the victim's system via the helper

How to detect it

Review Git client logs and command history for invocations of git-remote-ext with unexpected URLs; inspect .gitmodules and .git/config files in cloned repositories for protocol schemes other than the standard git, http, https, or ssh.

What your security team should do

• Prioritize patching Git across all developer workstations, CI/CD pipelines, and build servers within the next 30 days
• Implement repository scanning to detect unsafe protocol references in .gitmodules before merges
• Restrict use of git submodule update --init --recursive on untrusted repositories until upgrades complete