A vulnerability in Git allows a remote server to inject arbitrary file writes via the bundle-uri parameter during repository cloning. This occurs because the Git client does not sufficiently validate advertised bundles fetched from the server, potentially enabling protocol injection. The vulnerability can lead to arbitrary code execution in the worst case. The feature enabling bundle URIs is not enabled by default and can be controlled by configuration. Some exploitation scenarios require control over the clone destination or recursive cloning, which can be mitigated by disabling recursive clones. Fixed versions are available starting from 2.50.1.