Remediating the May 2018 Git Security Vulnerability

This post announces the disclosure of CVE 2018-11235, a Git security vulnerability allowing arbitrary code execution via malicious repositories. It details the fix in Git 2.17.1 and Git for Windows 2.17.1(2), and explains how Visual Studio Team Services (VSTS) now blocks such malicious repositories server-side. The technical explanation covers how submodules can be exploited by checking in repository data that includes hooks, which are then executed during a recursive clone.