Git 2.26.1 patches credential helper injection flaw

The Git project has shipped version 2.26.1 to close a security hole in the credential helper mechanism, which affects Git 2.26 and all earlier releases. A malformed remote URL passed to git clone—whether supplied directly on the command line or embedded in a submodule—can inject arbitrary data into the credential helper protocol stream. For users who rely on a credential helper, such as one tied to the operating system’s keychain, an attacker can leverage this to redirect credentials for one repository to any destination they choose.

The vulnerability was reported by Felix Wilhelm of Google Project Zero.

Immediate mitigation steps

Upgrading to Git 2.26.1 is the recommended fix and fully addresses the issue. If you cannot upgrade at once, minimize exposure by following these precautions:

  • Do not run git clone with --recurse-submodules against untrusted repositories
  • Avoid using the credential helper entirely when cloning publicly accessible repositories

Platform-level protections

GitHub has rolled out additional safeguards to blunt potential attacks:

  • Prevented malicious .gitmodules files from being pushed to GitHub.com
  • Scheduled a GitHub Desktop update for later today that blocks exploitation of this vulnerability
  • Patched recent GitHub Enterprise releases to stop the vulnerability from being used in Pages

The GitHub Enterprise patches are included in versions 2.17.21, 2.18.15, 2.19.10, and 2.20.4. Next week, a further release will ship the same protections used on GitHub.com, which block malicious .gitmodules files from reaching your installation.

Download Git 2.26.1