Every CVE Search/ Get API key

CVE-2014-9390

JGit Improper Input Validation vulnerability

9.8 CriticalPublic exploitFix available

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

75.6%Down 2.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Record
CVE-2014-9390
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Record
CVE-2014-9390
Updated
2026-11-02
EUVDEUVD-2020-0110 No score

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Record
EUVD-2020-0110
Updated
2026-11-03
GitHub AdvisoriesGHSA-6vvc-c2m3-cjf3 9.3

JGit Improper Input Validation vulnerability

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Record
GHSA-6vvc-c2m3-cjf3
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 9.8

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Record
CVE-2014-9390
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2014-9390 9.8

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Record
DEBIAN-CVE-2014-9390
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 7 moreShow less
OSVGHSA-6vvc-c2m3-cjf3 9.3

JGit Improper Input Validation vulnerability

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Record
GHSA-6vvc-c2m3-cjf3
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVUBUNTU-CVE-2014-9390 9.8

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Record
UBUNTU-CVE-2014-9390
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2014-0546 No score

Updated git packages fix security vulnerability

It was reported that git, when used as a client on a case-insensitive filesystem, could allow the overwrite of the .git/config file when the client performed a "git pull". Because git permitted committing .Git/config (or any case variation), on the pull this would replace the user's .git/config. If this malicious config file contained defined external commands (such as for invoking and editor or an external diff utility) it could allow for the execution of arbitrary code with the privileges of the user running the git client (CVE-2014-9390).

Record
MGASA-2014-0546
Updated
2026-11-02
OSVMGASA-2015-0325 No score

Updated cgit package fixes security vulnerability

cgit in Mageia 4/5 bundles an old git that is being subject to a minor security issue (CVE-2014-9390). The cgit package was updated to its latest upstream release, and updates the bundled git to the non-vulnerable version 2.5.0, which contains various bug fixes.

Record
MGASA-2015-0325
Updated
2026-11-02
OSVopenSUSE-SU-2024:10099-1 No score

git-2.11.0-1.1 on GA media

These are all security issues fixed in the git-2.11.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10099-1
Updated
2026-11-02
OSVPYSEC-2020-217 No score

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Record
PYSEC-2020-217
Updated
2026-11-02
OSVUSN-2470-1 No score

git vulnerability

Matt Mackall and Augie Fackler discovered that Git incorrectly handled certain filesystem paths. A remote attacker could possibly use this issue to execute arbitrary code if the Git tree is stored in an HFS+ or NTFS filesystem. The remote attacker would need write access to a Git repository that the victim pulls from.

Record
USN-2470-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.eclipse.jgit:org.eclipse.jgit
Maven
 before 3.5.3
3.5.3
mercurial
PyPI
 before 3.2.3
3.2.3
dulwich
Debian:12
 before 0.10.1-1
0.10.1-1
dulwich
Debian:13
 before 0.10.1-1
0.10.1-1
dulwich
Debian:14
 before 0.10.1-1
0.10.1-1
git
Debian:12
 before 1:2.1.4-1
1:2.1.4-1
git
Debian:13
 before 1:2.1.4-1
1:2.1.4-1
git
Debian:14
 before 1:2.1.4-1
1:2.1.4-1
jgit
Debian:12
 before 3.7.0-1
3.7.0-1
jgit
Debian:13
 before 3.7.0-1
3.7.0-1
Show 17 moreShow less
Affected packages
PackageAffectedFixed
jgit
Debian:14
 before 3.7.0-1
3.7.0-1
libgit2
Debian:12
 before 0.21.3-1
0.21.3-1
libgit2
Debian:13
 before 0.21.3-1
0.21.3-1
libgit2
Debian:14
 before 0.21.3-1
0.21.3-1
mercurial
Debian:12
 before 3.1.2-2
3.1.2-2
mercurial
Debian:13
 before 3.1.2-2
3.1.2-2
mercurial
Debian:14
 before 3.1.2-2
3.1.2-2
mercurial
Debian:6.0
From an advisory covering 2 CVEs
 before 1.6.4-1+deb6u1, plus listed versions
1.6.4-1
1.6.4-1+deb6u1
org.eclipse.jgit:org.eclipse.jgit
Maven
 before 3.5.3, plus listed versions
1.2.0.201112221803-r1.3.0.201202151440-r2.0.0.201206130900-r2.1.0.201209190230-r2.2.0.201212191850-r
Show 18 moreShow less
2.3.1.201302201838-r3.0.0.201306101825-r3.1.0.201310021548-r3.2.0.201312181205-r3.3.0.201403021825-r3.3.1.201403241930-r3.3.2.201404171909-r3.4.0.201405051725-m73.4.0.201405211411-rc13.4.0.201405281120-rc23.4.0.201406041058-rc33.4.0.201406110918-r3.4.1.201406201815-r3.4.2.201412180340-r3.5.0.201409071800-rc13.5.0.201409260305-r3.5.1.201410131835-r3.5.2.201411120430-r
3.5.3
mercurial
PyPI
 before 3.2.3, plus listed versions
0.8.10.90.9.10.9.20.9.3
Show 45 moreShow less
0.9.40.9.51.01.0.11.0.21.11.1.11.1.21.21.2.11.31.3.11.41.4.11.4.21.4.31.51.5.11.5.21.5.31.5.41.61.6.11.6.21.6.31.6.41.71.7.11.7.21.7.31.7.51.81.8.11.8.21.8.31.8.41.91.9.11.9.21.9.32.02.0.12.0.22.12.1.1
3.2.3
git
Mageia:4
 before 1.8.5.6-1.mga4
1.8.5.6-1.mga4
cgit
Mageia:4
 before 0.11.2-1.mga4
0.11.2-1.mga4
cgit
Mageia:5
 before 0.11.2-1.mga5
0.11.2-1.mga5
git
Ubuntu:14.04:LTS
 before 1:1.9.1-1ubuntu0.1, plus listed versions
1:1.8.3.2-11:1.8.4.2-11:1.8.4.3-11:1.8.4.4-11:1.8.5-1
Show 7 moreShow less
1:1.8.5.1-11:1.8.5.2-11:1.8.5.2-21:1.8.5.3-11:1.9~rc1-11:1.9.0-11:1.9.1-1
1:1.9.1-1ubuntu0.1
mercurial
Ubuntu:14.04:LTS
 before 2.8.2-1ubuntu1.3, plus listed versions
2.6.3-12.7.2-12.8.1-22.8.2-1ubuntu1
2.8.2-1ubuntu1.3
libgit2
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.19.0-20.19.0-2ubuntu0.40.19.0-2ubuntu0.4+esm10.19.0-2ubuntu0.4+esm2
 None known
git
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 2.11.0-1.1
2.11.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitMalicious Git and Mercurial HTTP Server For CVE-2014-93902014-12-18

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9390 is a critical vulnerability (CVSS 9.8) in Apple Xcode, published December 19, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 75.6%, the 99th percentile. Fixed in org.eclipse.jgit:org.eclipse.jgit 3.5.3.

References

Show 24 moreShow less
This page doesn't list everything

Left out here: 28 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open