Back to TIL
April 2026
posted on 04.12.2026

Bare Repository Attacks in Git

A bare repository is a Git repo with no working tree, just the .git internals. Git will recognize one anywhere it finds the right directory structure. An attacker can exploit this by embedding a bare repo inside a normal repository, tucked into a subdirectory or smuggled in via submodules.

When you clone the outer repo and cd into it, Git may auto-discover the embedded bare repo. If that bare repo has hooks configured (say, a post-checkout or pre-commit), they run on your machine. Arbitrary code, no prompt.

The fix landed in Git 2.38 with safe.bareRepository:

git config --global safe.bareRepository explicit

With explicit set, Git refuses to operate in any bare repository unless its path has been added to safe.directory. It won't auto-discover bare repos nested inside cloned projects.

Without this, cloning a repo someone hands you could silently execute whatever they put in a hook. The attack surface is small but the impact is full code execution.

No reactions yet

in Naperville, IL
Last visitor from Mitaka, Japan
⌘K