Check C12 · execution surface family · severity HIGH · automatic · one of the 22 checks
The question this check asks: does this repository carry a .gitmodules file — a list of other repositories that git will fetch, and can be made to act on, when someone clones this one recursively?
Submodules are the only route to genuine code execution during git clone itself. In CVE-2025-48384 (CVSS 8.0) a carriage return in a submodule's path caused git to write the submodule somewhere it did not intend, and a crafted repository used that to land a post-checkout hook that ran during the clone. It is on CISA's Known Exploited Vulnerabilities list — exploited in the wild, not theoretical — and GitHub Desktop amplified it because it clones recursively by default. The fix is git 2.50.1, or the matching point release on older lines (2.43.7, 2.44.4 and so on up to 2.49.1); the habit that survives the fix is to clone untrusted repositories without --recurse-submodules and initialise submodules only after review.
C12 reads the repository's file list — one API call, no clone — and fires when .gitmodules sits at the root. The finding is HIGH, costs 10 points, and reads “recursive clone → CVE-2025-48384 surface”. A repository that trips nothing else scores 90, the badge stays green, the verdict is REVIEW, and the default personal policy warns: the download is held, the finding is shown, proceeding is one click. It never blocks on its own. It belongs to the execution-surface group, whose evidence note in the scoring table sets the tone for the whole family:
“28.8% of top-100 repos carry devcontainers — informative, not damning”
Every project that vendors a dependency as a submodule — C and C++ libraries, documentation themes, firmware trees, anything with a third_party/ directory. The file is ordinary; what the finding buys you is knowing, before you clone, that a recursive clone will fetch code from repositories you have not looked at, and that your git version matters.
Two honest limits, one of them unusual. First, it sees the file, not its contents: a .gitmodules pointing at well-known upstreams and one with a crafted path look identical from the file list. Second — and this is the unusual one — a Download ZIP archive contains no submodule contents and runs no hooks. The download RepoGates is gating is not where this vulnerability fires; the clone you make afterwards is. This finding is a warning about the next step, delivered at the only step the product can see.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. C12 is the clearest case of that line: it warns about a clone it will never see.
Without installing anything: open .gitmodules on GitHub and read each url and path. With the GitHub CLI, and then your own git version:
gh api repos/OWNER/REPO/contents/.gitmodules --jq .content | base64 -d
git --versionThen clone without recursing, read what the submodules point at, and initialise them only if you want them:
git clone https://github.com/OWNER/REPO
git -C REPO submodule update --init # after review, not beforeAre submodules dangerous? Submodules are how thousands of legitimate projects vendor dependencies, and a .gitmodules file on its own is ordinary. What it opens is a clone-time path: CVE-2025-48384 let a carriage return in a submodule path plant a post-checkout hook that ran during a recursive clone, and it was exploited in the wild. The finding costs 10 points and warns so that you clone without recursing and update git.
If RepoGates gates the ZIP, why does a clone-time finding matter? Because the ZIP is usually not the end. A Download ZIP archive contains no submodule contents and runs no hooks, so this finding does not describe the download itself — it describes what happens if you then clone the project to work on it, which is what most people do next. The board tells you before the download what the clone will do.
Does RepoGates stop git clone? No. RepoGates gates browser-initiated downloads — Download ZIP and release-asset archives. It does not see git clone, package managers, curl, or fetches made by AI agents outside the browser. This finding is the clearest case: it warns about a clone it will never see.
C11 Nested bare repository — git running code on an ordinary command rather than during clone · C10 Devcontainer auto-execution — the editor doing the same on open · C14 Build scripts and wrapper JARs — the build doing it next.
Add RepoGates to Chrome Pricing
Numbers on this page: CVE-2025-48384 as published and listed by CISA; git release notes for 2.50.1 and its backports; weights and actions from the product's scoring and policy tables.