CVE-2020-5260

A flaw was found in git. Credentials can be leaked through the use of a crafted URL that contains a newline, fooling the credential helper to give information for a different host. Highest threat from the vulnerability is to data confidentiality.

Mitigation

The most complete workaround is to disable credential helpers altogether:

git config --unset credential.helper  
git config --global --unset credential.helper  
git config --system --unset credential.helper  

An alternative is to avoid malicious URLs:
1. Examine the hostname and username portion of URLs fed to git clone for the presence of encoded newlines (%0a) or evidence of credential-protocol injections (e.g., host=github.com)
2. Avoid using submodules with untrusted repositories (don't use clone --recurse-submodules; use git submodule update only after examining the URLs found in .gitmodules)
3. Avoid tools which may run git clone on untrusted URLs under the hood