reasonix: gitcmd's hardened git diff wrapper still executes attacker-controlled filter.<driver>.clean via .gitattributes, a residual gap the code itself already documents

Summary

Reasonix Studio's internal/gitcmd package hardens git invocations against config-driven RCE (core.fsmonitor=false, maintenance.auto=false, --no-ext-diff, --no-textconv), but this hardening does not cover git's filter.<driver>.clean/smudge content-filter mechanism. Filter drivers are assigned per-file via .gitattributes and defined via .git/config, and are invoked independently of the diff-side flags already in place.

The desktop app's workspace-changes diff viewer (desktop/workspace_changes.go) runs git diff --no-ext-diff --no-textconv on a changed file. This still triggers the configured clean filter to produce the comparison blob, resulting in arbitrary command execution when a victim views the diff of a file whose repository carries a malicious .gitattributes + .git/config pair.

Impact

Arbitrary command execution with the privileges of the user running Reasonix, triggered by ordinary use of a default UI feature (viewing a file's diff) — no unusual action required beyond opening a poisoned project directory.

Attack Vector

Requires both:

1. A tracked .gitattributes entry assigning a filter driver to a file (survives a normal git clone).
2. A local .git/config defining that driver's clean command (does not survive a plain clone — must arrive via archive/tarball, synced/shared folder, CI cache, or devcontainer image built with COPY . .).

Affected Versions

• esengine/DeepSeek-Reasonix (Reasonix Studio): main branch commit ea28602 and tagged pre-release studio-v2.9.0
• npm package reasonix < 1.39.3

Fixed Versions

2.21.0 (Reasonix Studio), 1.39.3 (npm package)

Remediation

Options include passing explicit -c filter.<name>.clean= / smudge= overrides for every driver name found in the repository's .gitattributes before diffing untrusted content, enforcing a fixed allowlist of trusted filter drivers, or reading blob contents via git cat-file/go-git to avoid invoking filters entirely for byte-level diffs.