SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Eight flaws in seven coding agents let repository git config run commands on open

0
·5 views

Manifold Security disclosed eight vulnerabilities across seven command-line coding agents in early September 2026, under the name GitSpawn. The flaws exploit git's core.fsmonitor setting, which runs a configured command, and agents that call git status or git diff in the background when a project opens. Because a repository's local .git/config can carry such a command, a payload can execute as the user outside the agent's sandbox without an approval prompt. The issue affects repositories arriving as files, such as zipped archives or synced folders, rather than cloned ones, since clones do not transfer local config. Patch status varies: some agents are fixed, while others remained unpatched in the most recent published retest.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Browser-Based Spreadsheet Editor Handles XLSX and CSV Files Without Server Uploads

UCDREAMS has released a free spreadsheet editor that parses, edits, recalculates, and exports XLSX and CSV files entirely within the browser. The developers say the approach avoids the server costs, memory exhaustion, and privacy risks that come with uploading files to cloud-based conversion services. The editor relies on WebAssembly and Web Workers, which unzip and parse workbook XML off the main thread so large files load quickly without freezing the interface. To keep scrolling smooth, it uses virtualized rendering that mounts only the cells visible in the viewport rather than tens of thousands of DOM nodes. The article presents the design as a way to give finance teams and other users with confidential data real-time editing without sending files to third-party servers.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Platform Automates VAT Calculation from Amazon Transaction Reports

A cross-border tax compliance provider built an online platform to replace the manual, spreadsheet-heavy process of computing VAT from Amazon VAT Transactions Reports. Each transaction is sorted into one of seven sales categories based on who collects the tax, whether the buyer holds a valid VAT number, and whether the sale is domestic, intra-EU or an export. Country-specific treatment is stored in a single lookup table rather than in scattered conditional rules, so adding a jurisdiction means filling in that table. The system currently calculates tax live for the UK and eight EU countries, with cross-border rules for all 27 member states. UK import VAT is handled separately through C79 certificates, C88 declarations and Postponed VAT Accounting amounts, which sellers upload alongside the Amazon report.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Audio transcription 503 errors call for distinct handling of outages and model readiness in moderation pipelines

The article argues that an HTTP 503 response and a model reporting unavailable are separate signals that should be handled differently. It proposes deciding on fallbacks through a capability registry rather than the status code alone. Moderation systems should record pending reviews as waiting with a stated reason, instead of storing them as empty transcripts. Retries should occur only for transient conditions on operations that are safe to repeat, and provider switches should happen only after capability, region, and data policies are verified. The author also recommends normalizing provider errors behind a provider-neutral adapter so that moderation logic stays stable.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Why Offset Pagination Breaks on Live Data and When Cursors Work Better

Offset pagination is simple and accurate for small, static result sets, but it fails on live data. When rows are inserted or deleted between requests, pages can skip or repeat records, and deep offsets slow down because the database still processes the skipped rows. Cursor pagination solves both problems by returning an opaque marker tied to a stable position in an ordered set, keeping pages consistent and efficient. The trade-off is that cursors do not support jumping to arbitrary pages or showing total page counts, so offset remains suitable for bounded admin tables while cursors fit feeds and timelines.

0 comments Read more at DEV Community