Post #3854667

2026-07-16 06:46 UTC

@Sempf@infosec.exchange @ifin@infosec.exchange I made a half-assed effort to test macOS, and couldn’t replicate, but it may not have been sufficient. That makes me wonder if this is purely a bad decision in VSCode to prefer a repo-level git executable, or an interaction of VSCode with OS-level functionality hitting an unintended edge case on one (admittedly primary) platform. I also wonder if disabling the Git extension mitigates the vulnerability. That and a targeted look at source code might turn up some hints about cross-platform applicability (or point to other functionality that could be abused).

Replies (2)

@milomb@infosec.exchange 2026-07-16 08:54

@ajn142@infosec.exchange @Sempf@infosec.exchange @ifin@infosec.exchange Isn't this just Windows shell effectively having ./ at the head of its search path (even though it's not literally in the PATH var), and vstudio using Process.Start() or something to launch "git.exe" with the repo root as CWD? I don't think they're intentionally trying to use a local version of git. It's basically the same as if you cd to that repo root in a cmd.exe shell and typed "git.exe" -- I'm pretty sure that has the same behavior. You wouldn't see it on MacOS or (most) Linux distros. (sorry, this is from memory/ddg, have no Windows box atm to check)

Open ##3854666
@wdormann@infosec.exchange 2026-07-16 11:51

@ajn142@infosec.exchange @Sempf@infosec.exchange @ifin@infosec.exchange I couldn't replicate this either. At least not what they describe. https://infosec.exchange/@wdormann/116919751130550410

Open ##3857818