You'll notice
Useful3 Signal2
Git now refuses the ext, fd, git, ftp and ftps transports, closing a command-execution path.
What's wrong with this entry?
Anonymous. No account, no email.
What
Git invocations now carry flags that refuse the ext, fd, git, ftp and ftps transports. The ext protocol in particular can make a repository run arbitrary commands, so a hostile remote or submodule URL can no longer reach it through Claude Code.
Details
- Applied as a fixed set of
-c protocol.<name>.allow=neversettings, not conditional on any flag. - HTTPS and SSH remotes are unaffected.
Evidence
protocol.ext.allow=never
Strings lifted out of the shipped bundle, so the claim above can be checked against them.