CVE-2015-8968: squareup git-fastclone
Vulnerability summary
CVE-2015-8968 is a high (CVSS 9.3) vulnerability in squareup git-fastclone. EPSS estimates a 5.20% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 03-11-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
git-fastclone before 1.0.1 permits arbitrary shell command execution from .gitmodules. If an attacker can instruct a user to run a recursive clone from a repository they control, they can get a client to run an arbitrary shell command. Alternately, if an attacker can MITM an unencrypted git clone, they could exploit this. The ext command will be run if the repository is recursively cloned or if submodules are updated. This attack works when cloning both local and remote repositories.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · RubygemsEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.20%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
No change 0.00 pp
From 5.20% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
RubyGems1 product
- git-fastclone< 1.0.1
Squareup1 product
- git-fastclone< 1.0.1
2 vendors · 2 products
