# Git argument injection via user refs

User ref, path or URL reaching a git subcommand as a positional arg without a -- separator

_Area: Web injection and code execution. Seen in 8 disclosed reports; 6 confirmed bounties, median $6,500, range $100-$12,000; latest 2026-10-21. Updated 2026-10-23._

## How it works
A user-controlled string (ref, revision, path, URL) is placed as a positional argument to a CLI tool like git without a `--` separator. The tool's argument parser treats any value starting with `-` as an option, not data, so a ref like `--output=/path` or `--upload-pack=...` becomes a flag the tool obeys. The broken assumption: that a value used as a ref or path is always data. A related shape: when a Java app builds argv via forkAndExec/nuprocess, an embedded NUL byte splits one input into extra argv entries, injecting flags without a leading `-` in the original string [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-breaking-bitbucket-pre-auth-remote-command-execution-cve-2022-36804.md).

## Where it shows up
- A ref, revision, path or URL concatenated into a git subcommand (`git log`, `git grep`, `git archive`, `ls-remote`) with no `--` before it [E1](https://bugbountylibrary.com/r/h1%3A658013.md)[E3](https://bugbountylibrary.com/r/h1%3A1070247.md)[E5](https://bugbountylibrary.com/r/h1%3A587854.md)[E6](https://bugbountylibrary.com/r/h1%3A653125.md)[E7](https://bugbountylibrary.com/r/h1%3A682442.md).
- Go/Java wrappers that shell out to git with user args [E4](https://bugbountylibrary.com/r/h1%3A1763704.md)[E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-breaking-bitbucket-pre-auth-remote-command-execution-cve-2022-36804.md).
- NUL bytes in input splitting into new argv entries via forkAndExec/nuprocess [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-breaking-bitbucket-pre-auth-remote-command-execution-cve-2022-36804.md).
- Sibling endpoints sharing one command builder after a fix landed elsewhere [E7](https://bugbountylibrary.com/r/h1%3A682442.md).

## How to review
Grep for process-spawn sinks: `exec.Command`, `Runtime.exec`, `subprocess`, `nuprocess`. For each, trace whether user input reaches a positional argument. The invariant: a `--` separator must precede all user-controlled positional arguments, and the value must not be interpretable as an option. Confirm the wrapper passes args as an array (not a shell string), rejects or neutralizes leading `-`, and strips NUL bytes. Order matters: `--` only protects positionals after it, so it must sit between flags and the ref/path, not before the flags. Git subcommands vary in how they accept `--`; verify per subcommand. Test sibling scopes and endpoints that reuse the same builder [E7](https://bugbountylibrary.com/r/h1%3A682442.md).

## Variants seen
- Ref param to `git log`/`git grep` parsed as `--output`/`--no-index` [E1](https://bugbountylibrary.com/r/h1%3A658013.md)[E7](https://bugbountylibrary.com/r/h1%3A682442.md).
- Commit param to `git log` parsed as `--output=` writing arbitrary files [E3](https://bugbountylibrary.com/r/h1%3A1070247.md).
- Ref name to `git log`/`rev-list` parsed as a flag, leaking a secret [E6](https://bugbountylibrary.com/r/h1%3A653125.md).
- NUL-delimited argv injection into `git archive` via `%00` [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-breaking-bitbucket-pre-auth-remote-command-execution-cve-2022-36804.md).
- `--upload-pack=` in a Go SDK wrapper [E4](https://bugbountylibrary.com/r/h1%3A1763704.md).
- Directory path to `git archive` parsed as `--output=` [E5](https://bugbountylibrary.com/r/h1%3A587854.md).

## Why fixes fail
A fix for one scope (`wiki_blobs`) left the sibling `blobs` scope vulnerable through the same command builder [E7](https://bugbountylibrary.com/r/h1%3A682442.md). Patching one call site without a shared safe wrapper leaves other paths open.

## Impact and severity
Led to arbitrary file overwrite and SSH-key RCE as the git user [E1](https://bugbountylibrary.com/r/h1%3A658013.md)[E3](https://bugbountylibrary.com/r/h1%3A1070247.md)[E5](https://bugbountylibrary.com/r/h1%3A587854.md), secret/token disclosure [E6](https://bugbountylibrary.com/r/h1%3A653125.md)[E7](https://bugbountylibrary.com/r/h1%3A682442.md), and pre-auth RCE [E2](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-breaking-bitbucket-pre-auth-remote-command-execution-cve-2022-36804.md). Severity is high because a single unsanitized positional arg yields code execution; worse when unauthenticated or when the service runs with broad filesystem access.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A658013.md
- E2: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-breaking-bitbucket-pre-auth-remote-command-execution-cve-2022-36804.md
- E3: https://bugbountylibrary.com/r/h1%3A1070247.md
- E4: https://bugbountylibrary.com/r/h1%3A1763704.md
- E5: https://bugbountylibrary.com/r/h1%3A587854.md
- E6: https://bugbountylibrary.com/r/h1%3A653125.md
- E7: https://bugbountylibrary.com/r/h1%3A682442.md