The rest of the examples.

Newline in a filename

A newline in a name can forge an entire extra line of output: a single file that appears to be two.

$ git status --short
A  notes
injected.txt

# one file, printed as two lines

[WARN] path 'notes\ninjected.txt' contains a tab
       or newline byte, anomalous in a filename;
       it can forge diff-output lines.

The catch: the raw name is scanned before it prints; the newline is called out instead of forging a line.

Backdoor path: A control character in a path can redirect a checkout to an unintended location (e.g. a hooks directory), turning a committed file into code that runs on clone.

Seen in the wild: a carriage return in a submodule path redirects a clone into git's hooks (CVE-2025-48384), exploited in the wild and listed in CISA's KEV catalog. Not attributed to a named group in public reporting.

File becomes a symlink

A regular file is replaced by a symlink: a type change a content diff barely registers.

-A regular file that a branch turns into a symlink.
+/nonexistent/DEMO-TARGET

# looks like a one-line content edit

MODE CHANGE 'swap.txt': 100644 -> 120000
SYMLINK 'swap.txt':
   '(regular file)' -> '/nonexistent/DEMO-TARGET'

The catch: the mode flip (100644 -> 120000) and the new link target are both shown, not mistaken for a text edit.

Backdoor path: Replace a file with a symlink so a later checkout writes through it into .git/hooks (or outside the worktree), planting an executable hook.

Seen in the wild: an in-the-wild git RCE chained a symlink into .git (CVE-2025-48384). In CISA's KEV catalog; no public named-group attribution.

Invalid UTF-8 byte

An undecodable byte (0xFF) is not valid text at all. Rather than guess at a rendering, the tool refuses.

$ cat data/config.env
checksum=�� not valid utf-8

# replacement chars, or mojibake, or nothing

[WARN] data/config.env suspicious Unicode (rc=2):
[ERROR] triggered a fatal error in unicode-show.
        Failing closed.
[NOTICE] set GIT_REVIEW_UNICODE_NONFATAL=1 to review anyway.

The catch: undecodable input can't be rendered safely, so review stops: fail closed, not best-effort.

Backdoor path: Undecodable bytes blind naive review tooling and can crash a viewer: cover for smuggling a payload a reviewer's editor renders as harmless mojibake.

Lone carriage return

A bare CR returns the cursor to column 0, so the text after it overwrites the text before. cat shows only the second half.

$ cat data/config.env
DELETE_EVERYTHING=no

# a CR erased "DELETE_EVERYTHING=yes" in front of it

[WARN] data/config.env suspicious Unicode:
    -> U+000D CARRIAGE RETURN (Cc)
--- diff (neutralized) ---
+ DELETE_EVERYTHING=yes_DELETE_EVERYTHING=no

The catch: the CR is defanged to _, so both halves show. The yes can't hide behind the no.

Backdoor path: A carriage return mid-line overwrites the visible text, so the reviewer reads LOG_LEVEL=info while the committed line ends ; echo ATTACKER_KEY >> ~/.ssh/authorized_keys.

Tab in a filename

A tab inside a name can forge column separation in git status or diff output, so one file reads as two.

$ git status --short
A  notes	evil.txt

# the tab looks like a column break

[WARN] path 'notes\tevil.txt' contains a tab or
       newline byte, anomalous in a filename;
       it can forge diff-output lines.

The catch: a filename is untrusted data too; a tab is named, not printed raw.

Backdoor path: A tab forges column breaks in git status, so a second malicious file hides inside what looks like one benign entry: an extra file slipped past review.

.gitattributes in a non-ASCII dir

The -diff hiding trick, but the .gitattributes sits in a non-ASCII-named directory that git quotes in its output, so a naive text match would miss it.

$ git diff --name-only
"m\303\266r/.gitattributes"

# quoted (core.quotePath): a match for
# '.gitattributes' slips right past

[ERROR] .gitattributes changed. It can hide
        OTHER files' contents from the diff.
        Failing closed.

The catch: the gate reads raw NUL-separated names, so the quoting can't sneak a .gitattributes past it.

Backdoor path: The same -diff hiding trick, placed in a non-ASCII directory git quotes in its output, so even reviewers grepping for '.gitattributes' miss it. The backdoored file shows no diff.

Dangling symlink

A new symlink points at a nonexistent target. Viewers that follow the link render it empty, as if nothing was added.

$ cat link-dangling
cat: link-dangling: No such file or directory

# a viewer that stats the target sees nothing

SYMLINK 'link-dangling':
   '(none)' -> '../nowhere/DEMO-MISSING'

The catch: the link text is shown directly, so a broken target can't read as "empty, nothing here".

Backdoor path: A symlink to a not-yet-existing target is the setup half of a symlink attack: a later step, or a case-insensitivity race, creates the target and redirects a write into .git/.