# Git's --end-of-options Flag and Security Implications

A critical flag discovery for Git command-line security.

- **Source:** [Hacker News](https://news.ycombinator.com)
- **Published:** 2026-07-21
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://nesbitt.io/2026/07/21/end-of-options.html>
- **On Brifing:** https://brifing.si/s/722a4856-5d4f-45b5-987b-b4bbb3a0f58b

## Discovery of --end-of-options in Git

The --end-of-options flag, introduced in Git 2.24.0, was designed to secure command-line argument processing. Unlike the traditional Unix -- marker, this flag is used to separate revisions and pathspecs in Git.

## Risk of Argument Injection

Tools like Git, hg, and ssh offer options to execute user-defined commands. These features can lead to malicious argument injection. Known as CWE-88, this security flaw occurs directly via the argv array without shell involvement.

## Security Vulnerabilities in Package Managers

Many package managers pass Git URLs and references to subprocesses. Those lacking protection against argument injection may face CVEs. Tools like Bundler, Composer, and Poetry have encountered such vulnerabilities.

## Git's Historical Behavior

Git repurposed the -- marker to separate revisions from pathspecs. This left the revision position without a terminator. The --end-of-options flag was introduced to eliminate this ambiguity.

## Correct Usage of the Flag

To safely pass an untrusted revision, use git log --end-of-options "$rev" -- "$path". This ensures both markers perform their separate roles effectively.

## Subcommand Support

Support for --end-of-options wasn't added to all Git subcommands at once. For instance, git rev-parse only gained support in version 2.30.0. git checkout and git reset rejected it until version 2.43.1.

## Package Manager Fixes

Most package managers don't use --end-of-options when forking Git subprocesses. Go's cmd/go is the sole exception. Others rely on the -- marker or leading-dash checks.

## Future Precautions

Git and other tools need more structural changes to prevent argument injection. For now, the --end-of-options flag plays a critical role in mitigating such vulnerabilities. Proper usage by developers is paramount.

## Sources covering this story

- https://nesbitt.io/2026/07/21/end-of-options.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._