Coding-agent CLI lets an untrusted workspace's own .git/config execute code through its background git calls (GitSpawn)

coding-agent-git-config-exec is a high severity check in the ai category, written in shell. Its source is templates/ai/coding-agent/coding-agent-git-config-exec.sh in cert-x-gen-templates.

What it checks

Assembles a workspace directory (as FILES, never via git clone) whose own .git/config carries the four ways git runs a repo-chosen program on ordinary read operations - core.fsmonitor (any index refresh: git status, git diff), a clean/smudge filter (git diff on an attributed file), core.sshCommand (git ls-remote against an ssh remote), and core.hooksPath - each pointing at a benign command that writes its own nonce into this template’s lab. A host-git positive control first proves which of those vectors this machine’s git actually executes; a benign repo then proves the target shells out to git for context at all. The target is then pointed at the malicious workspace with a hermetic HOME and a logging git shim. CONFIRMED when a live vector’s nonce appears: the target’s unattended, startup context-gathering git call made git run an attacker-chosen command out of a directory nobody approved - before any workspace-trust prompt, before auth, outside any sandbox. This is not the agent’s own config format (coding-agent-repo-config-autoexec covers that); the executor here is git itself.

There is a playbook for this check

GitSpawn: untrusted .git/config executes code through the agent’s background git sets out the use case, the probe flow, the oracle, and the fixture that proves it in both directions.

Header

Field	Value
Id	coding-agent-git-config-exec
Severity	high
Language	shell
Category	ai
Author	CERT-X-GEN Security Team
Template version	not recorded
Confidence	90
CVSS	not recorded
Weakness	CWE-94
Tags	ai, coding-agent, cli, untrusted-workspace, git, git-config, fsmonitor, hookspath, sshcommand, gitspawn, trust-boundary, autoexec, cwe-94, cwe-1188, cwe-829
Target kind	cli
Oracle	property

Conventions of the repository, not fields the engine reads

@target_kinds and @oracles are documented in the templates repository’s contribution guide, and cxg’s annotation parser does not carry them into a template’s metadata. Nothing at scan time selects on them. The annotation header schema is every field the parser does read.

References

Declared in the header. cxg parses @references and then discards it, and nothing at scan time reads it, so this is the only place the links a template cites are surfaced.

• https://thehackernews.com/2026/09/gitspawn-git-config-agent-rce.html

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info coding-agent-git-config-exec

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• ai is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.