# Untrusted repo config reaches command execution

Repo-local config values that select interpreters, executables or hooks and get spawned by the tool

_Area: Software supply chain and CI/CD. Seen in 3 disclosed reports; latest 2026-10-15. Updated 2026-10-30._

## How it works
A tool reads configuration from the repository it is operating on, and some of those config values name an interpreter, executable, or hook that the tool then spawns. The tool assumes repo-local config is data, but certain keys are effectively code: they choose what binary runs or what arguments it receives. When the tool trusts the local file, an attacker who controls the repo controls the command line. The same break appears when a sandbox allowlist includes a binary that executes code by design, or when a tool shells out to git and inherits git's implicit trust of discovered repos [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-g74g-rg72-j2p3.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-jxh8-jh77-xh6g.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-9ccr-r5hg-74gf.md).

## Where it shows up
- Settings that pick a shell or interpreter, or its arguments, for every spawned command [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-g74g-rg72-j2p3.md)
- Sandbox/allowlist entries for `npm`, `npx`, `git`, `tar`, or anything with lifecycle scripts or remote bin entries [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-jxh8-jh77-xh6g.md)
- Safety checks that only gate one runtime (e.g. `node`) and pass everything else through [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-jxh8-jh77-xh6g.md)
- Tools that run git in a project directory without disabling repo discovery or executable config keys (`core.fsmonitor`, `core.hookspath`, `diff.external`, `merge.tool`) [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-9ccr-r5hg-74gf.md)
- Fixes that strip settings by a per-field flag rather than by sink class [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-g74g-rg72-j2p3.md)

## How to review
Identify every config key whose value reaches a spawned process as an executable, interpreter, argument, or hook. The invariant: no value from an untrusted repo may influence which program runs or the arguments it receives, unless the user explicitly opted in. Check that the strip/denylist covers the whole sink class, not just fields already flagged. For sandboxes, verify each allowed binary cannot execute arbitrary code by design. For git callers, confirm discovery of nested/bare repos and executable config keys is disabled before any git command runs.

## Variants seen
- Local config overrides shell interpreter args, surviving a prior fix's `global_only` strip [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-g74g-rg72-j2p3.md)
- Sandbox allowlist admits `npm`/`npx`, so lifecycle scripts run from unsigned control-plane tasks [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-jxh8-jh77-xh6g.md)
- Nested bare repo with `core.fsmonitor` executes commands during routine git operations [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-9ccr-r5hg-74gf.md)

## Why fixes fail
E1's fix was a per-field denylist: only forge credential sinks were marked `global_only`, leaving the four shell-args settings that select the interpreter for every command unflagged. Enumerating the sink class, not the reported field, is required [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-g74g-rg72-j2p3.md).

## Impact and severity
Arbitrary command execution on developer machines and CI/validator nodes, triggered by opening or operating on an untrusted repo or by a compromised control plane [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-g74g-rg72-j2p3.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-jxh8-jh77-xh6g.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-9ccr-r5hg-74gf.md). Severity is high because no user action beyond normal tool use is needed; unsigned control-plane responses and agentic tools that shell out widen exposure [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-jxh8-jh77-xh6g.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-9ccr-r5hg-74gf.md).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-g74g-rg72-j2p3.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-jxh8-jh77-xh6g.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-9ccr-r5hg-74gf.md