CVE-2015-8968

git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.

• CWE-77

• http://www.securityfocus.com/bid/81433Third Party Advisory, VDB Entry
• https://github.com/square/git-fastclone/pull/2Patch, Vendor Advisory
• https://hackerone.com/reports/104465Exploit, Third Party Advisory
• http://www.securityfocus.com/bid/81433Third Party Advisory, VDB Entry
• https://github.com/square/git-fastclone/pull/2Patch, Vendor Advisory
• https://hackerone.com/reports/104465Exploit, Third Party Advisory

Published

Nov 3, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8962Double free vulnerability in the sg_common_write function in…7.3
• CVE-2015-8963Race condition in kernel/events/core.c in the Linux kernel b…7
• CVE-2015-8964The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.…
• CVE-2015-8965Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1…9.8
• CVE-2015-8966arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before…
• CVE-2015-8967arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allow…7.8
• CVE-2015-8969git-fastclone before 1.0.5 passes user modifiable strings di…9.8
• CVE-2015-8970crypto/algif_skcipher.c in the Linux kernel before 4.4.2 doe…
• CVE-2015-8971Terminology 0.7.0 allows remote attackers to execute arbitra…7.8
• CVE-2015-8972Stack-based buffer overflow in the ValidateMove function in …9.8
• CVE-2015-8973xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and …
• CVE-2015-8974SQL injection vulnerability in the Group Promotions module i…