Every CVE Search/ Get API key

CVE-2015-7545

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4...

9.8 CriticalPublic exploitFix available

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

18.7%Up 7.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Record
CVE-2015-7545
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20, CWE-284
Updated
2026-11-02
CVE List No score

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Record
CVE-2015-7545
Updated
2026-11-02
EUVDEUVD-2015-7460 No score

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Record
EUVD-2015-7460
Updated
2026-11-03
GitHub AdvisoriesGHSA-3rvg-chjx-7h2j 9.8

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4...

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Record
GHSA-3rvg-chjx-7h2j
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 9.8

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Record
CVE-2015-7545
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2015-7545 9.8

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Record
DEBIAN-CVE-2015-7545
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2015-7545 9.8

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.

Record
UBUNTU-CVE-2015-7545
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:10070-1 No score

mercurial-4.0-1.1 on GA media

These are all security issues fixed in the mercurial-4.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10070-1
Updated
2026-11-02
OSVSUSE-SU-2015:2025-1 No score

Recommended update for git

The git package was updated to fix the following security issue:

  • CVE-2015-7545: Fix remote code execution with recursive fetch of submodules (bsc#948969).
Record
SUSE-SU-2015:2025-1
Updated
2026-11-02
OSVSUSE-SU-2015:2325-1 No score

Recommended update for git

The git package was updated to fix the following security issue:

  • CVE-2015-7545: Fix remote code execution with recursive fetch of submodules (bsc#948969).
Record
SUSE-SU-2015:2325-1
Updated
2026-11-02
OSVUSN-2835-1 No score

git vulnerability

Blake Burkhart discovered that the Git git-remote-ext helper incorrectly handled recursive clones of git repositories. A remote attacker could possibly use this issue to execute arbitrary code by injecting commands via crafted URLs.

Record
USN-2835-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
git
Debian:12
 before 1:2.6.1-1
1:2.6.1-1
git
Debian:13
 before 1:2.6.1-1
1:2.6.1-1
git
Debian:14
 before 1:2.6.1-1
1:2.6.1-1
git
Debian:7
 before 1:1.7.10.4-1+wheezy2, plus listed versions
1:1.7.10.4-1+wheezy1
1:1.7.10.4-1+wheezy2
git
Debian:8
 before 1:2.1.4-2.1+deb8u1, plus listed versions
1:2.1.4-2.1
1:2.1.4-2.1+deb8u1
git19-emacs-git
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-emacs-git-el
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-git
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-git-all
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-git-cvs
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
Show 101 moreShow less
Affected packages
PackageAffectedFixed
git19-git-daemon
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-git-debuginfo
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-git-email
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-git-gui
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-git-svn
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-gitk
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-gitweb
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-perl-Git
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-perl-Git-SVN
Red Hat:rhel_software_collections:2::el6
 before 0:1.9.4-3.el6.1
0:1.9.4-3.el6.1
git19-emacs-git
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-emacs-git-el
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-git
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-git-all
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-git-bzr
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-git-cvs
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-git-daemon
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-git-debuginfo
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-git-email
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-git-gui
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-git-hg
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-git-svn
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-gitk
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-gitweb
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-perl-Git
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
git19-perl-Git-SVN
Red Hat:rhel_software_collections:2::el7
 before 0:1.9.4-3.el7.1
0:1.9.4-3.el7.1
emacs-git
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
emacs-git-el
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-all
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-bzr
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-cvs
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-daemon
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-email
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-gui
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-hg
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-p4
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-svn
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
gitk
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
gitweb
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
perl-Git
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
perl-Git-SVN
Red Hat:enterprise_linux:7::client
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
emacs-git
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
emacs-git-el
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-all
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-bzr
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-cvs
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-daemon
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-email
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-gui
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-hg
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-p4
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-svn
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
gitk
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
gitweb
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
perl-Git
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
perl-Git-SVN
Red Hat:enterprise_linux:7::computenode
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
perl-Git
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
emacs-git
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
emacs-git-el
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-all
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-bzr
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-cvs
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-daemon
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-email
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-gui
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-hg
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-p4
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-svn
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
gitk
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
gitweb
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
perl-Git-SVN
Red Hat:enterprise_linux:7::server
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
perl-Git
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
emacs-git
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
emacs-git-el
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-all
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-bzr
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-cvs
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-daemon
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-email
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-gui
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-hg
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-p4
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git-svn
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
gitk
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
gitweb
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
perl-Git-SVN
Red Hat:enterprise_linux:7::workstation
 before 0:1.8.3.1-6.el7
0:1.8.3.1-6.el7
git
SUSE:Linux Enterprise Software Development Kit 12
 before 1.8.5.6-15.1
1.8.5.6-15.1
git
SUSE:Linux Enterprise Server 12
 before 1.8.5.6-15.1
1.8.5.6-15.1
git
SUSE:Linux Enterprise Server for SAP Applications 12
 before 1.8.5.6-15.1
1.8.5.6-15.1
git
SUSE:Linux Enterprise Software Development Kit 12 SP1
 before 1.8.5.6-15.1
1.8.5.6-15.1
git
SUSE:Linux Enterprise Server 12 SP1
 before 1.8.5.6-15.1
1.8.5.6-15.1
git
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 1.8.5.6-15.1
1.8.5.6-15.1
git
Ubuntu:14.04:LTS
 before 1:1.9.1-1ubuntu0.2, plus listed versions
1:1.8.3.2-11:1.8.4.2-11:1.8.4.3-11:1.8.4.4-11:1.8.5-1
Show 8 moreShow less
1:1.8.5.1-11:1.8.5.2-11:1.8.5.2-21:1.8.5.3-11:1.9~rc1-11:1.9.0-11:1.9.1-11:1.9.1-1ubuntu0.1
1:1.9.1-1ubuntu0.2
mercurial
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 4.0-1.1
4.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubavuserow/bug-free-chainsaw2015-12-16

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-7545 is a critical vulnerability (CVSS 9.8) in Git Project Git, published December 9, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 18.7%, the 97th percentile. Fixed in git 1:2.6.1-1.

References

Show 38 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open