{"id":"GHSA-57q7-rxqq-7vgp","aliases":["GO-2022-0424"],"status":"published","title":"On Windows, `git-sizer` might run a `git` executable within the repository being analyzed","description":"### Impact\nOn Windows, if `git-sizer` is run against a non-bare repository, and that repository has an executable called `git.exe`, `git.bat`, etc., then that executable might be run by `git-sizer` rather than the system `git` executable. An attacker could try to use social engineering to get a victim to run `git-sizer` against a hostile repository and thereby get the victim to run arbitrary code.\n\nOn Linux or other Unix-derived platforms, a similar problem could occur if the user's `PATH` has the current directory before the path to the standard `git` executable, but this is would be a very unusual configuration that has been known for decades to lead to all kinds of security problems.\n\n### Patches\nUsers should update to git-sizer v1.4.0\n\n### Workarounds\nIf you are on Windows, then either\n* Don't run `git-sizer` against a repository that might contain hostile code, or, if you must…\n* Run `git-sizer` against a bare clone of the hostile repository, or, if that is not possible…\n* Make sure that the hostile repository doesn't have an executable in its top-level directory before running `git-sizer`.\n\nIf you are on Linux or other Unix-based system, then (for myriad reasons!) don't add the current directory to your `PATH`.\n\n### References\n* [Command PATH security in Go](https://blog.golang.org/path-security)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the `git-sizer` project](https://github.com/github/git-sizer).\n* Email us at [GitHub support](mailto:support@github.com).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-02-15T01:57:18Z","modified":"2026-03-03T04:49:54Z","fixes":[{"ecosystem":"Go","package":"github.com/github/git-sizer","fixed_in":["1.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/github/git-sizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.3.0"},{"fixed":"1.4.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/github/git-sizer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/github/git-sizer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]}],"references":[{"url":"https://github.com/github/git-sizer/security/advisories/GHSA-57q7-rxqq-7vgp","tags":["web","advisory"]},{"url":"https://github.com/github/git-sizer/commit/38400d6ddd79325e956b00ff584cfcc8dd96d536","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-57q7-rxqq-7vgp"}],"sources":{"ghsa":[{"id":"GHSA-57q7-rxqq-7vgp","title":"On Windows, `git-sizer` might run a `git` executable within the repository being analyzed","description":"### Impact\nOn Windows, if `git-sizer` is run against a non-bare repository, and that repository has an executable called `git.exe`, `git.bat`, etc., then that executable might be run by `git-sizer` rather than the system `git` executable. An attacker could try to use social engineering to get a victim to run `git-sizer` against a hostile repository and thereby get the victim to run arbitrary code.\n\nOn Linux or other Unix-derived platforms, a similar problem could occur if the user's `PATH` has the current directory before the path to the standard `git` executable, but this is would be a very unusual configuration that has been known for decades to lead to all kinds of security problems.\n\n### Patches\nUsers should update to git-sizer v1.4.0\n\n### Workarounds\nIf you are on Windows, then either\n* Don't run `git-sizer` against a repository that might contain hostile code, or, if you must…\n* Run `git-sizer` against a bare clone of the hostile repository, or, if that is not possible…\n* Make sure that the hostile repository doesn't have an executable in its top-level directory before running `git-sizer`.\n\nIf you are on Linux or other Unix-based system, then (for myriad reasons!) don't add the current directory to your `PATH`.\n\n### References\n* [Command PATH security in Go](https://blog.golang.org/path-security)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the `git-sizer` project](https://github.com/github/git-sizer).\n* Email us at [GitHub support](mailto:support@github.com).","status":"published","published":"2022-02-15T01:57:18Z","modified":"2023-01-09T05:04:45Z","updated_at":"2026-11-02T14:36:10.502376Z"}],"osv":[{"id":"GHSA-57q7-rxqq-7vgp","title":"On Windows, `git-sizer` might run a `git` executable within the repository being analyzed","description":"### Impact\nOn Windows, if `git-sizer` is run against a non-bare repository, and that repository has an executable called `git.exe`, `git.bat`, etc., then that executable might be run by `git-sizer` rather than the system `git` executable. An attacker could try to use social engineering to get a victim to run `git-sizer` against a hostile repository and thereby get the victim to run arbitrary code.\n\nOn Linux or other Unix-derived platforms, a similar problem could occur if the user's `PATH` has the current directory before the path to the standard `git` executable, but this is would be a very unusual configuration that has been known for decades to lead to all kinds of security problems.\n\n### Patches\nUsers should update to git-sizer v1.4.0\n\n### Workarounds\nIf you are on Windows, then either\n* Don't run `git-sizer` against a repository that might contain hostile code, or, if you must…\n* Run `git-sizer` against a bare clone of the hostile repository, or, if that is not possible…\n* Make sure that the hostile repository doesn't have an executable in its top-level directory before running `git-sizer`.\n\nIf you are on Linux or other Unix-based system, then (for myriad reasons!) don't add the current directory to your `PATH`.\n\n### References\n* [Command PATH security in Go](https://blog.golang.org/path-security)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the `git-sizer` project](https://github.com/github/git-sizer).\n* Email us at [GitHub support](mailto:support@github.com).","status":"published","published":"2022-02-15T01:57:18Z","modified":"2024-08-21T15:42:04.991517Z","updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GO-2022-0424","title":"On Windows, `git-sizer` might run a `git` executable within the repository being analyzed in github.com/github/git-sizer","description":"On Windows, `git-sizer` might run a `git` executable within the repository being analyzed in github.com/github/git-sizer","status":"published","published":"2024-08-21T15:11:31Z","modified":"2026-03-03T04:49:54.930523Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}