Git

CVEs (64)

• CVE-2025-48385HigJul 8, 2025
  Git

  Git
  risk 0.49cvss —epss 0.01

  Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows…

• CVE-2022-24975HigFeb 11, 2022
  Git

  Git
  risk 0.49cvss 7.5epss 0.03

  The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has…

• CVE-2021-46101HigJan 31, 2022
  Git

  Git
  risk 0.49cvss 7.5epss 0.01

  In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.

• CVE-2018-11233HigMay 30, 2018
  Git

  Git
  risk 0.49cvss 7.5epss 0.04

  In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

• CVE-2025-66413HigMar 10, 2026
  Git

  Git
  risk 0.48cvss 7.4epss 0.00

  Git for Windows is the Windows port of Git. Prior to 2.53.0(2), it is possible to obtain a user's NTLM hash by tricking them into cloning from a malicious server. Since NTLM hashing is weak, it is possible for the attacker to brute-force the user's account name and password.…

• CVE-2022-25648HigApr 19, 2022
  Git

  Git
  risk 0.46cvss 8.1epss 0.05

  The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags…

• CVE-2021-23632MedMar 17, 2022
  Git

  Git
  risk 0.43cvss 6.6epss 0.02

  All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js…

• CVE-2022-24765MedApr 12, 2022
  Git

  Git
  risk 0.39cvss 6.0epss 0.01

  Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be…

• CVE-2022-39253MedOct 19, 2022
  Git

  Git
  risk 0.36cvss 5.5epss 0.01

  Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performing a local clone (where the source and…

• CVE-2017-15298MedOct 14, 2017
  Git

  Git
  risk 0.36cvss 5.5epss 0.02

  Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not…

• CVE-2025-48386MedJul 8, 2025
  Git

  Git
  risk 0.34cvss 6.3epss 0.00

  Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against…

• CVE-2018-1000021MedFeb 9, 2018
  Git

  Git
  risk 0.33cvss 5.0epss 0.01

  GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their…

• CVE-2024-32021LowMay 14, 2024
  Git

  Git
  risk 0.25cvss 3.9epss 0.01

  Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source repository that contains symlinks via the filesystem, Git may create hardlinks to arbitrary user-readable files on the same filesystem as…

• CVE-2019-1348LowJan 24, 2020
  Git

  Git
  risk 0.14cvss 3.3epss 0.00

  An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting…

• CVE-2018-17456CriOct 6, 2018
  Git

  Git
  risk 0.11cvss 9.8epss 0.97

  Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a…

• CVE-2021-21300HigMar 9, 2021
  Git

  Git
  risk 0.10cvss 8.0epss 0.89

  Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a…

• CVE-2022-23521CriJan 17, 2023
  Git

  Git
  risk 0.05cvss 9.8epss 0.56

  Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for…

• CVE-2023-25652HigApr 25, 2023
  Git

  Git
  risk 0.04cvss 7.5epss 0.52

  Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially…

• CVE-2022-41903CriJan 17, 2023
  Git

  Git
  risk 0.04cvss 9.8epss 0.44

  Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer…

• CVE-2008-5517Jan 13, 2009
  Git

  Git
  risk 0.04cvss —epss 0.12

  The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary commands via shell metacharacters related to (1) git_snapshot and (2) git_object.