CVE-2015-8968

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
n/a	git-fastclone ruby gem All versions before 1.0.1	git-fastclone ruby gem All versions before 1.0.1

References

http://www.securityfocus.com/bid/81433Third Party Advisory, VDB Entry
https://github.com/square/git-fastclone/pull/2Patch, Vendor Advisory
https://hackerone.com/reports/104465Exploit, Third Party Advisory
http://www.securityfocus.com/bid/81433Third Party Advisory, VDB Entry
https://github.com/square/git-fastclone/pull/2Patch, Vendor Advisory
https://hackerone.com/reports/104465Exploit, Third Party Advisory

Timeline

Published: Nov 3, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-89699.8git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifyi CVE-2015-89705.5crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been performed on an AF_ALG socket befo CVE-2015-89717.8Terminology 0.7.0 allows remote attackers to execute arbitrary commands via escape sequences that modify the window title and then are writt CVE-2015-89729.8Stack-based buffer overflow in the ValidateMove function in frontend/move.cc in GNU Chess (aka gnuchess) before 6.2.4 might allow context-de CVE-2015-89738.3xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to CVE-2015-897410.0SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x CVE-2015-89756.1Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Me CVE-2015-89766.1Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8 CVE-2015-89777.5MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the inst CVE-2015-89787.5In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each CVE-2015-89797.5Stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allows remote attackers to CVE-2015-89809.8The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.