ACVE-2026-0424

In the wild

demonstrated · news

Description

What

The cited disclosure shows that a malicious .git configuration can influence Claude, Codex, Cursor, and other agent workflows when the agent runs git in an untrusted repository. The configuration is a cross-harness command-execution path; it extends the existing repository trust concern without claiming a named victim campaign.

Which configuration is exposed

The exposed setup is an agent that runs git commands in a repository whose .git/config, includes, or hooks are attacker-controlled. The exact harness varies, but the common condition is trust in repository-local git configuration. A clean repository or disabled git integration is outside the match.

How ACVE detects it

ACVE flags the named harness target set. Discovery does not parse every git include, execute hooks, or know whether the repository was obtained from an attacker. The finding requires a repository review before it becomes an incident conclusion.

Fix

Treat repository git configuration as untrusted, disable automatic hook and include execution where possible, and review .git/config and hooks before allowing an agent to operate. Use a sandbox and approval for git-adjacent commands.

Grounding needed

The disclosure should be checked for the affected harness list and command path. This record is a demonstrated cross-harness chain with no confirmed victim source, so it is not promoted to exploited-itw.

This record is limited to the condition named in the public source: Malicious git configuration can run agent code in an untrusted repo. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

harness.id in ["claude-code","codex-cli","cursor"]

Fix

Disable untrusted git config execution and review repository hooks.

• Reconfigure trust.level to untrusted. Do not execute repository-provided git configuration.
• Remove repository .git/config includes and hooks. Remove attacker-controlled commands.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

No references recorded.