CVE-2020-26233

CVE-2020-26233 describes a vulnerability in Git Credential Manager Core (GCM Core) on Windows, affecting versions prior to 2.0.289. When recursively cloning a Git repository with submodules, a malicious git.exe placed in the top-level repository could be executed instead of the legitimate Git binary, leading to potential compromise. This is a high-severity vulnerability (CVSS 7.3) with a complex attack vector requiring high privileges and user interaction, but it could result in high confidentiality and integrity impacts. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.