CVE-2020-5260

CVE-2020-5260 is a high-severity vulnerability affecting Git versions prior to April 14th, 2020, including products from Canonical, Debian, Fedora, OpenSUSE, and Git itself. It allows an attacker to trick Git's credential helper into sending private credentials for one legitimate server to a malicious server via specially crafted URLs containing encoded newlines. The attack vector is network-based with low complexity, requiring no user interaction beyond processing a malicious URL, and can lead to a complete compromise of sensitive information (CVSS 7.5). While the vulnerability can be triggered by git clone, it is more likely to occur through automated systems like Git submodules. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.