Git

CVEs (64)

• CVE-2014-9390CriFeb 12, 2020
  Git

  Git
  risk 0.66cvss 9.8epss 0.75

  Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all…

• CVE-2017-1000117HigOct 5, 2017
  Git

  Git
  risk 0.66cvss 8.8epss 0.78

  A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an…

• CVE-2015-7545CriApr 13, 2016
  Git

  Git
  risk 0.65cvss 9.8epss 0.19

  The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in…

• CVE-2019-1353CriJan 24, 2020
  Git

  Git
  risk 0.64cvss 9.8epss 0.02

  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none…

• CVE-2017-14867HigSep 29, 2017
  Git

  Git
  risk 0.60cvss 8.8epss 0.36

  Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The…

• CVE-2019-1387HigDec 18, 2019
  Git

  Git
  risk 0.58cvss 8.8epss 0.04

  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted…

• CVE-2016-2324CriApr 8, 2016
  Git

  Git
  risk 0.58cvss 9.8epss 0.19

  Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.

• CVE-2016-2315CriApr 8, 2016
  Git

  Git
  risk 0.58cvss 9.8epss 0.18

  revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.

• CVE-2025-48384HigKEVJul 8, 2025
  Git

  Git
  risk 0.57cvss 8.0epss 0.03

  Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config…

• CVE-2024-52005HigJan 15, 2025
  Git

  Git
  risk 0.57cvss 8.8epss 0.01

  Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed…

• CVE-2025-46334HigJul 10, 2025
  Git

  Git
  risk 0.56cvss 8.6epss 0.00

  Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an…

• CVE-2025-46835HigJul 10, 2025
  Git

  Git
  risk 0.55cvss 8.5epss 0.00

  Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite files for which the user…

• CVE-2022-39260HigOct 19, 2022
  Git

  Git
  risk 0.55cvss 8.5epss 0.03

  Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the…

• CVE-2018-11235HigMay 30, 2018
  Git

  Git
  risk 0.55cvss 7.8epss 0.49

  In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone…

• CVE-2020-5260CriApr 14, 2020
  Git

  Git
  risk 0.54cvss 9.3epss 0.10

  Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker. Git uses external "credential helper" programs to store and retrieve passwords or other credentials from secure storage provided by the…

• CVE-2022-31012HigJul 12, 2022
  Git

  Git
  risk 0.53cvss 8.2epss 0.00

  Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute a binary into `C:\mingw64\bin\git.exe` by mistake. This only happens upon a fresh install, not when upgrading Git for…

• CVE-2022-29187HigJul 12, 2022
  Git

  Git
  risk 0.51cvss 7.8epss 0.00

  Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privilege escalation in all platforms. An unsuspecting user could still be affected by the issue reported in CVE-2022-24765,…

• CVE-2019-19604HigDec 11, 2019
  Git

  Git
  risk 0.51cvss 7.8epss 0.04

  Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.

• CVE-2014-9938HigMar 20, 2017
  Git

  Git
  risk 0.50cvss 8.8epss 0.02

  contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.

• CVE-2025-27614HigJul 10, 2025
  Git

  Git
  risk 0.49cvss 8.6epss 0.00

  Gitk is a Tcl/Tk based Git history browser. Starting with 2.41.0, a Git repository can be crafted in such a way that with some social engineering a user who has cloned the repository can be tricked into running any script (e.g., Bourne shell, Perl, Python, ...) supplied by the…