CVE-2020-27955
Git LFS can execute a Git binary from the current directory
Git LFS 2.12.0 allows Remote Code Execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Git LFS 2.12.0 allows Remote Code Execution.
- Record
CVE-2020-27955- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-427
- Updated
- 2026-11-02
CVE List No score
Git LFS 2.12.0 allows Remote Code Execution.
- Record
CVE-2020-27955- Updated
- 2026-11-02
EUVDEUVD-2022-0812 No score
Git LFS 2.12.0 allows Remote Code Execution.
- Record
EUVD-2022-0812- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4g4p-42wc-9f3m
Git LFS can execute a Git binary from the current directory
Impact
On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.
This occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator.
Patches
This version should be patched in v2.12.1, which will be released in coordination with this security advisory.
Workarounds
Other than avoiding untrusted repositories, there is no workaround.
For more information
If you have any questions or comments about this advisory:
- Start a discussion in the Git LFS discussion page.
- If you cannot open a discussion, please email the core team using their usernames at
github.com.
- Record
GHSA-4g4p-42wc-9f3m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
OSV
Git LFS 2.12.0 allows Remote Code Execution.
- Record
CVE-2020-27955- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-4g4p-42wc-9f3m
Git LFS can execute a Git binary from the current directory
Impact
On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.
This occurs because on Windows, Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator.
Patches
This version should be patched in v2.12.1, which will be released in coordination with this security advisory.
Workarounds
Other than avoiding untrusted repositories, there is no workaround.
For more information
If you have any questions or comments about this advisory:
- Start a discussion in the Git LFS discussion page.
- If you cannot open a discussion, please email the core team using their usernames at
github.com.
- Record
GHSA-4g4p-42wc-9f3m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-427
- Updated
- 2026-11-02
OSVBIT-git-lfs-2020-27955 No score
Git LFS 2.12.0 allows Remote Code Execution.
- Record
BIT-git-lfs-2020-27955- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/git-lfs/git-lfsGo |
before 2.12.1 | 2.12.1 |
git-lfsBitnami |
2.12.0 up to 2.12.1 | 2.12.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Git Remote Code Execution via git-lfs (CVE-2020-27955) | 2020-11-04 |
| PoC in GitHub | Arnoldqqq/CVE-2020-27955 | 2021-05-13 |
| PoC in GitHub | DeeLMind/CVE-2020-27955-LFS | 2021-04-30 |
| PoC in GitHub | ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955 | 2020-11-03 |
| PoC in GitHub | ExploitBox/git-lfs-RCE-exploit-CVE-2020-27955-Go | 2020-11-04 |
| PoC in GitHub | FrostsaberX/CVE-2020-27955 | 2021-06-17 |
| PoC in GitHub | HK69s/CVE-2020-27955 | 2021-04-30 |
| PoC in GitHub | IanSmith123/CVE-2020-27955 | 2021-05-06 |
| PoC in GitHub | Kimorea/CVE-2020-27955-LFS | 2023-02-02 |
| PoC in GitHub | Marsable/CVE-2020-27955-LFS | 2021-05-25 |
Show 9 moreShow less
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | NeoDarwin/CVE-2020-27955 | 2021-03-30 |
| PoC in GitHub | TheTh1nk3r/cve-2020-27955 | 2020-12-28 |
| PoC in GitHub | nob0dy-3389/CVE-2020-27955 | 2021-05-23 |
| PoC in GitHub | r00t4dm/CVE-2020-27955 | 2020-11-24 |
| PoC in GitHub | the-chivalrousZ/cve-2020-27955 | 2025-10-27 |
| PoC in GitHub | userxfan/cve-2020-27955 | 2022-04-13 |
| PoC in GitHub | whitetea2424/CVE-2020-27955-LFS-main | 2021-08-02 |
| PoC in GitHub | yhsung/cve-2020-27955-poc | 2020-11-22 |
| PoC in GitHub | z50913/CVE-2020-27955 | 2022-12-16 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-27955 is a critical vulnerability (CVSS 9.8) in Git Large File Storage Project Large File Storage, published November 5, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 82.3%, the 99th percentile. Fixed in github.com/git-lfs/git-lfs 2.12.1.