Git — CraftedSignal Threat Feed

Claude Code Trust Dialog Bypass via Git Worktree Spoofing

hello@craftedsignal.io — Sat, 25 Apr 2026 12:00:00 +0000

A vulnerability in Claude Code, specifically versions 2.1.63 and later but before 2.1.84, allowed for a trust dialog bypass via Git worktree spoofing. This exploit leverages the way Claude Code determines folder trust using the commondir file in Git worktrees. By crafting a repository containing a commondir file that points to a path the victim has previously trusted, an attacker could bypass the trust dialog, leading to arbitrary code execution through malicious hooks defined in the .claude/settings.json file. Successful exploitation required the victim to clone a malicious repository and run Claude Code within it, as well as the attacker knowing or guessing a path the victim had previously trusted. Users on standard Claude Code with auto-update enabled received the fix automatically.

Attack Chain

Attacker crafts a malicious Git repository with a commondir file.
The commondir file is configured to point to a directory path the victim is likely to have previously trusted.
The repository includes a malicious .claude/settings.json file containing arbitrary code execution hooks.
Attacker distributes the malicious repository, likely through social engineering or other deceptive means.
Victim clones the malicious repository to their local machine using git clone.
Victim opens the cloned directory containing the malicious .claude/settings.json in a vulnerable version of Claude Code.
Claude Code reads the commondir file and incorrectly trusts the repository based on the spoofed path.
The malicious hooks defined in .claude/settings.json are executed, leading to arbitrary code execution on the victim’s machine.

Impact

Successful exploitation of this vulnerability allowed an attacker to execute arbitrary code on a victim’s machine. While the number of affected users is unknown, the impact of successful exploitation could range from data theft and system compromise to complete takeover of the victim’s development environment. The vulnerability primarily targeted developers using Claude Code, potentially impacting software development organizations.

Recommendation

Upgrade Claude Code to the latest version (>= 2.1.84) to patch CVE-2026-40068.
Implement a detection rule that identifies the creation or modification of .claude/settings.json files containing suspicious code (see Sigma rule below).
Monitor process creation events for unusual processes being launched from within the Claude Code application context (see Sigma rule below).

Tekton Pipelines Git Resolver API Token Leak via User-Controlled ServerURL

hello@craftedsignal.io — Wed, 22 Apr 2026 12:00:00 +0000

A vulnerability exists in Tekton Pipelines’ git resolver (versions v1.0.0 through v1.10.0) where the system-configured Git API token is sent to a user-controlled serverURL when the user omits the token parameter. This allows a malicious tenant with TaskRun or PipelineRun create permissions to exfiltrate the shared API token (GitHub PAT, GitLab token, etc.) by pointing serverURL to an attacker-controlled endpoint. The attacker can then use this token to gain unauthorized access to private repositories, potentially exposing source code, secrets, and CI/CD configurations. This vulnerability is similar to GHSA-j5q5-j9gm-2w5c, where credentials could be exfiltrated. The vulnerability resides in the ResolveAPIGit() function within pkg/resolution/resolver/git/resolver.go.

Attack Chain

Attacker gains permission to create TaskRuns or PipelineRuns within a Tekton Pipelines namespace.
Attacker crafts a malicious TaskRun or PipelineRun configuration.
The configuration specifies the git resolver in API mode.
The configuration omits the token parameter but includes a serverURL pointing to an attacker-controlled endpoint.
Tekton Pipelines executes the TaskRun or PipelineRun, triggering the git resolver.
The ResolveAPIGit() function retrieves the system-configured Git API token using getAPIToken().
The function creates an SCM client pointed at the attacker-controlled serverURL with the system token as an Authorization header.
Subsequent API calls from the resolver to the attacker-controlled URL transmit the system token, allowing the attacker to capture it.

Impact

Successful exploitation allows an attacker to exfiltrate the system Git API token (GitHub PAT, GitLab token, etc.). The exfiltrated token can be used to access private repositories, potentially leading to the exposure of sensitive information like source code, secrets, and CI/CD configurations. This can lead to supply chain compromise, data breaches, or other unauthorized activities. All Tekton Pipeline instances running versions v1.0.0 through v1.10.0 are potentially vulnerable if a system-level API token is configured.

Recommendation

Do not configure a system-level API token in the git resolver ConfigMap. Instead, require all users to provide their own tokens via the token parameter, as suggested in the advisory’s workaround section.
Restrict TaskRun creation to limit which users or ServiceAccounts can create TaskRuns and PipelineRuns that use the git resolver, as recommended in the advisory’s workaround section.
Apply NetworkPolicy to the tekton-pipelines-resolvers namespace to restrict outbound traffic to known-good Git servers only, mitigating the risk of token exfiltration to arbitrary serverURL values.

Git for Windows NTLM Hash Leak Vulnerability (CVE-2026-32631)

hello@craftedsignal.io — Wed, 15 Apr 2026 18:17:17 +0000

Git for Windows versions before 2.53.0.windows.3 are susceptible to a vulnerability (CVE-2026-32631) that exposes users’ NTLM hashes to malicious actors. This occurs when a user interacts with a specially crafted Git repository or branch hosted on an attacker-controlled server. The vulnerability stems from the lack of sufficient protections against unauthorized NTLM authentication requests during Git operations. The attack doesn’t require user interaction beyond the initial clone or checkout. Successful exploitation allows attackers to capture NTLMv2 hashes, which, while computationally expensive, can be brute-forced to recover user credentials. This vulnerability was patched in Git for Windows version 2.53.0.windows.3.

Attack Chain

Attacker sets up a malicious Git repository on a server under their control. This repository contains a Git configuration that triggers an NTLM authentication request to the attacker’s server.
The attacker crafts a social engineering campaign to entice the victim to clone the malicious repository using the git clone command.
Alternatively, the attacker compromises an existing Git repository and adds a malicious branch. The victim is then tricked into checking out this branch using git checkout.
When the victim clones the repository or checks out the malicious branch, Git for Windows attempts to authenticate with the attacker’s server using the NTLM protocol.
The victim’s NTLMv2 hash is sent to the attacker’s server during the NTLM authentication handshake.
The attacker captures the NTLMv2 hash from the authentication traffic.
The attacker initiates an offline brute-force attack against the captured NTLMv2 hash.
Upon successful brute-forcing, the attacker recovers the victim’s credentials and can use them to access other resources.

Impact

Successful exploitation of CVE-2026-32631 allows attackers to steal user credentials. The impact includes unauthorized access to sensitive data, systems, and applications accessible with the compromised credentials. The number of potential victims is directly related to the number of users running vulnerable versions of Git for Windows who interact with malicious repositories or branches. Targeted sectors are broad, encompassing any organization using Git for Windows for software development and version control.

Recommendation

Upgrade Git for Windows to version 2.53.0.windows.3 or later to remediate CVE-2026-32631.
Implement network monitoring to detect NTLM authentication attempts originating from Git processes to unusual or external destinations.
Deploy the Sigma rule “Detect Git Process Spawning Cmd with /c net use” to detect potential NTLM authentication attempts and adjust it to monitor outbound network connections from git.exe using NTLM.

Vim and Emacs Remote Code Execution Vulnerabilities Triggered by File Opening

hello@craftedsignal.io — Tue, 31 Mar 2026 21:45:14 +0000

A researcher at Calif discovered vulnerabilities in Vim and GNU Emacs using the Claude AI assistant. The Vim vulnerability (versions 9.2.0271 and earlier) results from missing security checks in modeline handling, allowing arbitrary code execution when a specially crafted file is opened. A patch is available in version 9.2.0272. The GNU Emacs vulnerability stems from its integration with Git’s version control (vc-git) and remains unpatched. Opening a file can trigger Git operations via vc-refresh-state, leading to the execution of arbitrary commands defined in a user-controlled core.fsmonitor program within a hidden .git/config file. This affects users who open files from untrusted sources.

Attack Chain

Attacker creates a malicious archive containing a text file and a hidden .git/ directory.
The .git/ directory includes a config file.
The config file contains a core.fsmonitor entry pointing to a malicious executable.
The attacker distributes the archive (e.g., via email or shared drive).
Victim extracts the archive on their system.
The victim opens the seemingly benign text file within GNU Emacs.
GNU Emacs’ vc-git integration triggers vc-refresh-state.
vc-refresh-state causes Git to read the attacker-controlled .git/config file and execute the malicious core.fsmonitor program, achieving arbitrary code execution.

Impact

Successful exploitation of these vulnerabilities leads to arbitrary code execution with the privileges of the user running Vim or Emacs. For Vim, all versions 9.2.0271 and earlier are affected until patched. While the Emacs vulnerability remains unpatched, it poses a significant risk to users who routinely open files from unknown or untrusted sources, potentially leading to system compromise and data breaches. The number of potential victims is substantial given the widespread use of these editors by developers and system administrators.

Recommendation

Upgrade Vim to version 9.2.0272 or later to patch the RCE vulnerability related to modeline handling (refer to the Vim flaw and fix section).
Exercise extreme caution when opening files from unknown sources or downloaded online when using GNU Emacs due to the unpatched Git integration vulnerability (refer to the GNU Emacs points to Git section).
Deploy the Sigma rule to detect execution of git with unusual core.fsmonitor configuration to your SIEM and tune for your environment.