# Git's --end-of-options Flag and Security Implications

A critical flag discovery for Git command-line security.

- **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91)
- **Published:** 2026-07-21
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://nesbitt.io/2026/07/21/end-of-options.html>
- **On Brifing:** https://brifing.si/s/367d70b6-f439-4d3c-b9d2-02b533642a09

## An Unexpected Flag in Git

Git's --end-of-options flag, added in 2019, remains relatively unknown. Unlike the traditional -- marker, it serves a special role in separating revisions and pathspecs. This flag enables secure command-line argument passing in Git operations.

## Historical Context

Git initially repurposed -- to separate revisions from file paths, creating a terminator gap in revision positions. --end-of-options was designed to address this vulnerability and prevent argument injection attacks in version control operations.

## POSIX Incompatibility

While most Unix tools use -- to terminate options, Git assigned it a different meaning. This inconsistency created security risks. The --end-of-options flag was specifically developed to resolve this compatibility issue in Git's argument parsing.

## Argument Injection Threat

Tools like Git, Mercurial and SSH contain options that execute caller-specified commands. Malicious arguments can exploit these features. Classified as CWE-88, this risk differs from command injection as it occurs without shell involvement during direct exec calls.

## Package Manager Risks

Package managers frequently pass Git URLs to subprocesses. Research shows only 1 of 17 package managers uses --end-of-options by default. This leaves many systems vulnerable to argument injection through dependency specifications.

## CVEs and Security Vulnerabilities

Between 2017-2025, similar argument injection vulnerabilities were reported across Git, Mercurial, Subversion and CVS. Popular tools like Docker, Bundler and Composer were affected. Proper use of --end-of-options significantly mitigates these risks.

## Implementation Challenges

--end-of-options support was added incrementally across Git subcommands. Rev-parse gained it in 2.30.0, while checkout and reset only implemented it in 2.43.1 (2024). This delay stems from Git's complex argument parsing architecture.

## Secure Coding Recommendations

Secure Git usage requires proper combination of --end-of-options and -- markers. Package managers and CI/CD systems should implement these flags consistently. Targeting Git 2.24+ versions becomes crucial for maintaining security in version control operations.

## Sources covering this story

- https://nesbitt.io/2026/07/21/end-of-options.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._