{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-72718",
    "name": "CVE-2026-72718",
    "vendor": "Eight findings across seven agents. Goose fixed",
    "description": "Manifold Security published eight code-execution findings on 1 September 2026 under the name GitSpawn, covering Claude Code, OpenAI Codex, Cursor, Goose, Qwen Code, Grok Build and Hermes Agent. Every agent tested failed. The mechanism is git's own core.fsmonitor setting, which names an external program git runs to speed up index checks, and which lives in a repository's .git/config rather than in the user's global config. All of these agents run a background git status to gather context before doing anything else, so the folder gets to choose the program git executes. Timing is what makes it severe rather than merely bad: on Claude Code and Hermes Agent the payload fires before the workspace-trust prompt is accepted, on Qwen Code before the user has even authenticated, and on Grok Build on the first keystroke. The delivery constraint is the one piece of good news and the thing most likely to be misread. A clone, fetch or pull never transmits a hostile .git/config, so this is not a browse-GitHub-and-get-owned attack; the dangerous case is a project folder handed over whole - a zip from a colleague, a shared drive, a restored backup, a sample project attached to a ticket. Goose shipped a fix and holds CVE-2026-72718 (CVSS 4.0 base 7.0, credited to Francisco Rosales); Hermes Agent was assigned CVE-2026-71963 independently after the vendor did not answer six contact attempts. Four of the eight findings were still unpatched at publication, and Anthropic published no advisory at all for the Claude Code finding.",
    "website": "https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-09-01",
    "risk": {
      "score": 70,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-72718",
      "aliases": [
        "ti-090"
      ],
      "title": "GitSpawn: A Line in .git/config Runs Attacker Code in Seven Coding Agents, Most of Them Before the Trust Prompt",
      "summary": "Manifold Security published eight code-execution findings on 1 September 2026 under the name GitSpawn, covering Claude Code, OpenAI Codex, Cursor, Goose, Qwen Code, Grok Build and Hermes Agent. Every agent tested failed. The mechanism is git's own core.fsmonitor setting, which names an external program git runs to speed up index checks, and which lives in a repository's .git/config rather than in the user's global config. All of these agents run a background git status to gather context before doing anything else, so the folder gets to choose the program git executes. Timing is what makes it severe rather than merely bad: on Claude Code and Hermes Agent the payload fires before the workspace-trust prompt is accepted, on Qwen Code before the user has even authenticated, and on Grok Build on the first keystroke. The delivery constraint is the one piece of good news and the thing most likely to be misread. A clone, fetch or pull never transmits a hostile .git/config, so this is not a browse-GitHub-and-get-owned attack; the dangerous case is a project folder handed over whole - a zip from a colleague, a shared drive, a restored backup, a sample project attached to a ticket. Goose shipped a fix and holds CVE-2026-72718 (CVSS 4.0 base 7.0, credited to Francisco Rosales); Hermes Agent was assigned CVE-2026-71963 independently after the vendor did not answer six contact attempts. Four of the eight findings were still unpatched at publication, and Anthropic published no advisory at all for the Claude Code finding.",
      "severity": "high",
      "cvss": {
        "score": 7,
        "vector": null,
        "version": "4.0"
      },
      "cwe": [],
      "attackType": [
        "Remote code execution"
      ],
      "componentType": "agent",
      "component": {
        "name": "Eight findings across seven agents. Goose fixed",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Eight findings across seven agents. Goose fixed (CVE-2026-72718); the Codex and Cursor variants were reported as duplicates and have been patched; four findings, including Claude Code and Hermes Agent (CVE-2026-71963), were unpatched at the 1 Sept 2026 write-up. No Anthropic advisory was published, so there is no version to check against for Claude Code.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-01",
      "modifiedAt": "2026-09-01",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72718"
        }
      ],
      "mitigation": "Patch state will not tell you whether you are exposed here, because four of the eight findings have no fix and one vendor published no advisory, so treat this as a handling rule rather than an upgrade. The rule is that a project folder is not the same object as a repository: a cloned repo cannot carry this, and a folder that arrived as an archive or on a share can. Tell developers that unzipping a shared project and opening it in an agent is the exact motion being exploited, and that deleting the folder's .git directory before opening it removes the vector outright when history is not needed. Where you control the wrapper, the upstream fix is one flag - invoke git -c core.fsmonitor=false status for background context gathering rather than a bare git status - and it is worth asking each vendor whether they have done that. For detection, core.fsmonitor is a legitimate setting almost nobody sets by hand, so a repository-local .git/config that sets it is a strong signal on its own.",
      "detectedByAnomity": true
    }
  }
}