GitSpawn Flaws Let Malicious Repositories Execute Code in Claude Code, Codex, Cursor and Grok

GitSpawn vulnerabilities allow malicious repositories to silently execute arbitrary code on a developer’s machine by exploiting background git commands that trigger unauthorized configuration hooks. To prevent this, developers should inspect .git/config files in unverified repositories, while vendors are urged to sanitize background context-gathering operations.