git-am applies commit message diffs

From: Matthias Beyer <mail@beyermatthias.de>
Date: Feb 6, 2026, 07:43 UTC
Message-ID: <bcqvh7ahjjgzpgxwnr4kh3hfkksfruf54refyry3ha7qk7dldf@fij5calmscvm>

Hi,

I am not sure whether this was already reported, searching the lore did not yield anything for me, but I might have overlooked it...

This was just posted on mastodon[0]:

    PSA: Did you know that it’s **unsafe** to put code diffs into your commit messages?

    Like https://
    github.com/i3/i3/pull/6564 for example

    Such diffs will be applied by patch(1) (also git-am(1)) as part of the code change!

    This is how a sleep(1) made it into i3 4.25-2 in Debian unstable.

TL;DR: If you put a diff in the commit message, that diff will be applied by git-am.

This looks clearly like unintended and might be an attack-vector, right?

Best, Matthias

[0]: https://mas.to/@zekjur/116022397626943871

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.