Check G12 · execution surface family · severity HIGH · automatic · one of the 22 GitLab checks
The question this check asks: does this project carry a .gitmodules file — a list of other repositories that git will fetch, and can be made to act on, when someone clones this one recursively?
Submodules are the only route to genuine code execution during git clone itself. In CVE-2025-48384 (CVSS 8.0) a carriage return in a submodule's path caused git to write the submodule somewhere it did not intend, and a crafted repository used that to land a post-checkout hook that ran during the clone. It is on CISA's Known Exploited Vulnerabilities list — exploited in the wild, not theoretical — and any client that clones recursively by default amplifies it. The fix is git 2.50.1, or the matching point release on older lines (2.43.7, 2.44.4 and so on up to 2.49.1); the habit that survives the fix is to clone untrusted projects without --recurse-submodules and initialise submodules only after review.
On gitlab.com the clone this finding is about is git clone https://gitlab.com/… or glab repo clone, and clone is the verb in the one documented gitlab.com pattern: Microsoft's account of the Contagious Interview campaign (11 March 2026) has victims "instructed to clone and execute" a package hosted on GitHub, GitLab or Bitbucket. What git does during that clone is the same on every host.
G12 is the same check as C12, run by the same code on a file list gitlab.com answers in one call. It fires when .gitmodules sits at the project root. The finding is HIGH, costs 10 points, and reads “recursive clone → CVE-2025-48384 surface”. A project that trips nothing else scores 90, the badge stays green, the verdict is REVIEW, and the default personal policy warns: the finding is shown, proceeding is one click. It never blocks on its own. It belongs to the execution-surface group, whose evidence note in the scoring table sets the tone for the whole family:
“28.8% of top-100 repos carry devcontainers — informative, not damning”
Measured on 19 September 2026 across the 100 most-starred gitlab.com projects, it fired on 16 — the most common of the auto-execution rows there, and more than on GitHub's 100 most-starred, read the same day by the same engine, where it fired on 6. inkscape/inkscape is the shape: REVIEW at 79 on 18 September, with a stale release and CMake beside the submodule file; fdroid/fdroidclient carries one beside binary release assets and a build wrapper.
Every project that vendors a dependency as a submodule — C and C++ libraries, documentation themes, firmware trees, anything with a third_party/ directory — and on gitlab.com's top 100 that is one project in six. The file is ordinary; what the finding buys you is knowing, before you clone, that a recursive clone will fetch code from repositories you have not looked at, and that your git version matters.
Two honest limits, one of them unusual. First, it sees the file, not its contents: a .gitmodules pointing at well-known upstreams and one with a crafted path look identical from the file list. Second — and this is the unusual one — the archive gitlab.com serves from the project's Code menu, /-/archive/<ref>/<project>-<ref>.zip, contains no submodule contents and runs no hooks. The download is not where this vulnerability fires; the clone you make afterwards is. This finding is a warning about the next step, delivered at the step the verdict can see.
RepoGates runs the same 22 checks on a gitlab.com project that it runs on a GitHub repository, from gitlab.com's public API, under the key gl/{namespace…}/{project}. What that API withholds from an anonymous caller — fork status, a user namespace's account age, and OpenSSF Scorecard, which does not cover gitlab.com — is listed as not checked, never assumed. A self-managed GitLab is another hostname and is not assessed. The repository's code is not read on this tier: a PASS means the provenance and the declared execution surface are clean.
Without installing anything: open .gitmodules on gitlab.com and read each url and path. From a terminal, with every / in the project path written as %2F, and then your own git version:
curl -s "https://gitlab.com/api/v4/projects/NAMESPACE%2FPROJECT/repository/files/.gitmodules/raw?ref=BRANCH"
git --versionThen clone without recursing, read what the submodules point at, and initialise them only if you want them:
git clone https://gitlab.com/NAMESPACE/PROJECT
git -C PROJECT submodule update --init # after review, not beforeAre submodules dangerous? Submodules are how thousands of legitimate projects vendor dependencies, and a .gitmodules file on its own is ordinary — 16 of the 100 most-starred gitlab.com projects carry one. What it opens is a clone-time path: CVE-2025-48384 let a carriage return in a submodule path plant a post-checkout hook that ran during a recursive clone, and it was exploited in the wild. The finding costs 10 points and warns so that you clone without recursing and update git.
If the download is an archive, why does a clone-time finding matter? Because the archive is usually not the end. The archive gitlab.com serves from the project's Code menu contains no submodule contents and runs no hooks, so this finding does not describe the download itself — it describes what happens if you then clone the project to work on it, which is what most people do next. The verdict tells you before the clone what the clone will do.
Does RepoGates stop git clone of a gitlab.com project? No. RepoGates does not see git clone, glab, package managers or curl run from a terminal, and the extension's board on gitlab.com pages is a later release. What reads a gitlab.com project today is the verdict API, the MCP server and the RepoGates plugin's hook on Claude Code's Bash tool, which sends a git clone https://gitlab.com/… or glab repo clone command line to preflight before it runs and answers on this check's dimension — a refusal or a question for that one tool call, not a wall around git. This finding is the clearest case: it warns about a clone that, outside that one hook, nothing sees.
C12 Submodule definitions — the GitHub original · G11 Nested bare repository — git running code on an ordinary command rather than during clone · G10 Devcontainer and Workspace devfile auto-execution — the editor, or the workspace, doing the same on open · G14 Build scripts and wrapper JARs — the build doing it next.
Add RepoGates to Chrome Pricing
Numbers on this page: CVE-2025-48384 as published and listed by CISA; git release notes for 2.50.1 and its backports; Microsoft's account of Contagious Interview, 11 March 2026; the 100 most-starred gitlab.com projects and GitHub's 100 as the control, read on 19 September 2026; weights and actions from the product's scoring and policy tables.