GitLens Git Local Configuration Execution

GitKraken GitLens versions prior to 14.0.0 allow an untrusted workspace to execute git commands. A repo may include its own .git folder including a malicious config file to execute arbitrary code. Tested against VSCode 1.87.2 with GitLens 13.6.0 on Ubuntu 22.04 and Windows 10.

arbitrary code code config configuration file folder git local malicious may own repo ubuntu ubuntu 22.04 untrusted vscode windows windows 10 workspace