Infra Audit5 min readUpdated November 4, 2026

Opening a Folder Is Enough: The Git fsmonitor Trap

It is a performance feature, not a bug, so there is no patch. VS Code, Cursor and Theia all trigger it. Here is the mechanism and the hardening.

core.fsmonitor in .git/config names a command git runs on every status. IDEs run status on folder open, so a malicious .git/config executes code the moment the folder opens. Harden with git config --global core.fsmonitor false.

fsmonitor is a performance optimization for large repos: instead of scanning every file, git asks a helper command which files changed. The helper is whatever command .git/config names. Git trusts local config, so it launches it on every status, add, commit and checkout.

See How We Work

In This Guide

The mechanism

fsmonitor is a performance optimization for large repos: instead of scanning every file, git asks a helper command which files changed. The helper is whatever command .git/config names. Git trusts local config, so it launches it on every status, add, commit and checkout.
fsmonitor is a performance optimization for large repos: instead of scanning every file, git asks a helper command which files changed. The helper is whatever command .git/config names. Git trusts local config, so it launches it on every status, add, commit and checkout. IDEs populate their source control panel by running git status the moment a folder opens. Open folder, git status, attacker command runs. Silent, no prompt, user privileges.

Why there is no patch

Git's maintainers consider local config trusted by design: the user owns the repo. The attack requires tricking the user into operating on a hostile .git directory, which happens through phishing (download this project), through buried bare repos, and through git-pillage tools that reconstruct .git from a webserver.
Git's maintainers consider local config trusted by design: the user owns the repo. The attack requires tricking the user into operating on a hostile .git directory, which happens through phishing (download this project), through buried bare repos, and through git-pillage tools that reconstruct .git from a webserver. Justin Steven's 2022 research showed several popular pillage tools themselves became RCE vectors when pointed at a crafted repo.

The hardening

Three lines: git config --global core.fsmonitor false as the machine default. git config --get core.fsmonitor in any repo from an unknown source. And keep git patched: CVE-2025-48384 (July 2025) turned git clone --recursive on a hostile repo into arbitrary file write and hook execution, with public PoCs.
Three lines: git config --global core.fsmonitor false as the machine default. git config --get core.fsmonitor in any repo from an unknown source. And keep git patched: CVE-2025-48384 (July 2025) turned git clone --recursive on a hostile repo into arbitrary file write and hook execution, with public PoCs. The audit checks the git version on dev machines and CI runners.

If it stays

Every developer who clones an untrusted repo, opens a downloaded project, or runs a pillage tool is one folder-open away from code execution on a machine that holds deploy keys and cloud credentials. The dev laptop is the most valuable target in the environment, and this vector needs no exploit, only curiosity.
Every developer who clones an untrusted repo, opens a downloaded project, or runs a pillage tool is one folder-open away from code execution on a machine that holds deploy keys and cloud credentials. The dev laptop is the most valuable target in the environment, and this vector needs no exploit, only curiosity.

4 Tips to Get Started

1

git config --get core.fsmonitor in any repo you did not create yourself. A command string there is a red flag.

2

Set git config --global core.fsmonitor false as the default on every dev machine.

3

Plain git clone cannot inject it, but buried bare repos inside a repo can. Do not run git tools against untrusted repos.

4

Related: CVE-2025-48384 makes git clone --recursive on untrusted repos RCE. Keep git updated.

Ready to Stop Worrying About Infra?

Knowledge is the first step. Get a free 1-hour diagnostic and see where your infrastructure leaks time, money, and focus.

Related Guides

Is My S3 Bucket Public? How to Check in One Command

One command tells you if your S3 bucket is public, and one curl proves it. The policy check shows intent, the anonymous request shows reality.

The Most Common AWS Misconfiguration (It Is One Line of Config)

Public buckets and Principal * policies cause most disclosed AWS incidents. Each is one line of config with account-wide blast radius. Here is the pattern.

Terraform State File Leak: Every Secret in Plaintext

terraform.tfstate stores database passwords, IAM keys and TLS private keys in plaintext. sensitive=true hides nothing. Here is how leaks happen and the check.

Docker Socket Mounted in a Container: Root on the Host, No Exploit Needed

A container with /var/run/docker.sock mounted controls the host daemon and can mount your entire filesystem. No kernel exploit required. Here is the mechanism and the check.

R

Ron Cohen — DevOps engineer & founder, roqy.io

Content reviewed by the roqy.io team. Our guides are based on publicly available data.

Disclaimer: This content is for informational and educational purposes only. It does not constitute professional advice or a guarantee of specific results. Infrastructure needs vary by team, stack, and stage. Consult a qualified engineer for advice tailored to your situation.

Frequently Asked Questions

Can opening a Git repository execute code?

Yes, via core.fsmonitor. The setting names a command that git runs on every status, add or commit. IDEs like VS Code and Cursor run git status automatically when a folder opens, so a crafted .git/config executes attacker code the moment the folder is opened. It is a feature, not a bug, so there is no patch.

Is fsmonitor exploitable via git clone?

Not directly: cloning does not let the remote control the client's .git/config. But a repository can contain a buried bare repo whose .git/config carries the payload, and tools or IDEs that operate on the inner repo trigger it. Justin Steven's 2022 research documented the chain.

How do I harden against it?

git config --global core.fsmonitor false on every developer machine and CI runner. Audit existing repos with git config --get core.fsmonitor. Keep git current: CVE-2025-48384 (fixed July 2025) made git clone --recursive on untrusted repos exploitable.

Get the DevOps Ecosystem Behind You

One accountable engineer. Full platform behind him. Month-to-month, no lock-in.

See How It Works