GitSpawn: How a Single Git Hook Flaw Lets Untrusted Repos Execute Code in Claude, Cursor, and Other AI Coding Agents
AI coding agents run git commands before you type anything. A hook execution flaw turns repository metadata into arbitrary code execution.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.