From: Matthias Beyer <mail@beyermatthias.de>
Date: Fri, 06 Feb 2026 07:43:56 GMT
Subject: git-am applies commit message diffs
Message-ID: <bcqvh7ahjjgzpgxwnr4kh3hfkksfruf54refyry3ha7qk7dldf@fij5calmscvm>

Hi,

I am not sure whether this was already reported, searching the lore did
not yield anything for me, but I might have overlooked it...

This was just posted on mastodon[0]:

    PSA: Did you know that it’s **unsafe** to put code diffs into your commit messages?

    Like https://
    github.com/i3/i3/pull/6564 for example

    Such diffs will be applied by patch(1) (also git-am(1)) as part of the code change!

    This is how a sleep(1) made it into i3 4.25-2 in Debian unstable.

TL;DR: If you put a diff in the commit message, that diff will be
applied by git-am.

This looks clearly like unintended and might be an attack-vector, right?

Best,
Matthias

[0]: https://mas.to/@zekjur/116022397626943871