Replies (2)

• @losttourist@social.chatty.monster 2026-09-24 06:58

  @gerikson@awful.systems @rmf@awful.systems Yeah I don't see how this is a vuln that specifically targets LLMs rather than just git users in general. If the vulnerable command is git checkout BLAH because BLAH has been poisoned from a SHA to a ref, that's going to affect anyone or anything that issues that command, human or machine, surely?

  Open ##4827600

• @rmf@awful.systems 2026-09-24 12:57

  Fwiw a similar problem is well-known in e.g. GitHub Actions. You can have your GHA scripts use “actions” written by other people, and the way you refer to them is user/repo@commit, where the commit can be a commit ID or a branch name or a tag name. The docs actually recommend pinning to commit IDs, but in practice most people actually pin to tags, like bob/doit@v1 because that will auto-update if bob fixes some bug and updates v1 to point to that. But if bob goes rogue, or gets compromised, the attacker could change the tag v1 to point to a malicious commit, though, hence the recommendation to use commit IDs for all actions that you didn’t write yourself. I don’t know if this ref/ID confusion can be exploited on GHA, but I would expect the answer is no, because GitHub Actions doesn’t launch git shell commands like a savage, but idk

  Open ##4830752