Git-for-windows Git vulnerabilities

• git-for-windows git Git for Windows: git-credential-wincred Erase Path Heap Overflow CVE-2026-100408 4.4 MediumNovember 4, 2026
• git-for-windows git Git for Windows: git-credential-wincred OAuth Store Heap Overflow CVE-2026-100407 4.4 MediumNovember 4, 2026
• git-for-windows git Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows CVE-2026-62960 Fix available 7.4 HighAugust 21, 2026
• git-for-windows git Git for Windows: `git clone` from manipulated repositories can leak NTLM hashes to arbitrary servers CVE-2026-32631 7.4 HighApril 15, 2026
• git-for-windows git Git for Windows leaks NTLM hash when cloning from an attacker-controlled server CVE-2025-66413 Fix available 7.4 HighMarch 10, 2026
• git Git allows a buffer overflow in 'wincred' credential helper CVE-2025-48386 Fix available 6.3 MediumJuly 8, 2025
• git Git alllows arbitrary file writes via bundle-uri parameter injection CVE-2025-48385 Fix available 8.6 HighJuly 8, 2025
• git, apple xcode, debian linux +2 more Git allows arbitrary code execution through broken config quoting CVE-2025-48384 In KEVPublic exploitFix available 8.1 HighJuly 8, 2025
• git The sideband payload is passed unfiltered to the terminal in git CVE-2024-52005 Public exploitFix available 7.5 HighJanuary 15, 2025
• git, debian linux +1 more Newline confusion in credential helpers can lead to credential exfiltration in git CVE-2024-52006 Fix available 2.1 LowJanuary 14, 2025
• git, debian linux +1 more Git does not sanitize URLs when asking for credentials interactively CVE-2024-50349 Fix available 2.1 LowJanuary 14, 2025
• git, debian linux, fedoraproject fedora +2 more Git's protections for cloning untrusted repositories can be bypassed CVE-2024-32465 Fix available 7.4 HighMay 14, 2024
• git, debian linux, fedoraproject fedora +2 more Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory CVE-2024-32021 Fix available 3.9 LowMay 14, 2024
• git, fedoraproject fedora +1 more Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will CVE-2024-32020 Fix available 3.9 LowMay 14, 2024
• git, debian linux, fedoraproject fedora +2 more Git vulnerable to Remote Code Execution while cloning special-crafted local repositories CVE-2024-32004 Public exploitFix available 8.2 HighMay 14, 2024
• git Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution CVE-2024-32002 Public exploitFix available EPSS 29.2% 9.1 CriticalMay 14, 2024
• git-for-windows git, git for windows project for windows +1 more Git CMD erroneously executes `doskey.exe` in the current directory, if it exists CVE-2023-29012 7.3 HighApril 25, 2023
• git-for-windows git, git for windows project for windows +1 more Git for Windows's config file of `connect.exe` is susceptible to malicious placing CVE-2023-29011 7.6 HighApril 25, 2023
• git, fedoraproject fedora +1 more Arbitrary configuration injection via `git submodule deinit` CVE-2023-29007 Public exploitFix available 7.0 HighApril 25, 2023
• git-for-windows git, git for windows project for windows, fedoraproject fedora +2 more Git looks for localized messages in the wrong place CVE-2023-25815 Fix available 3.3 LowApril 25, 2023
• git, fedoraproject fedora +1 more "git apply --reject" partially-controlled arbitrary file write CVE-2023-25652 Fix available EPSS 51.9% 7.5 HighApril 25, 2023
• git-for-windows git, git for windows project for windows +1 more Git for Windows' installer is susceptible to DLL side loading attacks CVE-2023-22743 7.3 HighFebruary 14, 2023
• git-for-windows git, git for windows project for windows +1 more gitk can inadvertently call executables in the worktree CVE-2023-23618 8.6 HighFebruary 14, 2023
• git Git's `git apply` overwriting paths outside the working tree CVE-2023-23946 Public exploitFix available 6.2 MediumFebruary 14, 2023
• git Git vulnerable to local clone-based data exfiltration with non-local transports CVE-2023-22490 Public exploitFix available 5.5 MediumFebruary 14, 2023
• git-for-windows git Git clone remote code execution vulnerability in git-for-windows CVE-2022-41953 Fix available 8.6 HighJanuary 17, 2023
• git Integer overflow in `git archive`, `git log --format` leading to RCE in git CVE-2022-41903 Public exploitFix available EPSS 44.3% 9.8 CriticalJanuary 17, 2023
• git gitattributes parsing integer overflow in git CVE-2022-23521 Fix available EPSS 56.3% 9.8 CriticalJanuary 17, 2023
• git, apple xcode, debian linux +1 more +3 more Git vulnerable to Remote Code Execution via Heap overflow in `git shell` CVE-2022-39260 Fix available 8.5 HighOctober 18, 2022
• git, apple xcode, debian linux +1 more +3 more Git subject to exposure of sensitive information via local clone of symbolic links CVE-2022-39253 Public exploitFix available 5.5 MediumOctober 18, 2022
• git-for-windows git Git for Windows' installer can be tricked into executing an untrusted binary CVE-2022-31012 8.2 HighJuly 12, 2022
• git, apple xcode, debian linux +1 more +3 more Bypass of safe.directory protections in Git CVE-2022-29187 Fix available 7.8 HighJuly 12, 2022
• git, debian linux, fedoraproject extra packages for enterprise linux +1 more +3 more Command Injection CVE-2022-25648 Fix available 8.1 HighApril 19, 2022
• git-for-windows git, apple xcode, debian linux +1 more +3 more Uncontrolled search for the Git directory in Git for Windows CVE-2022-24765 Fix available 6.0 MediumApril 12, 2022
• git-for-windows git Remote Code Execution (RCE) CVE-2021-23632 6.6 MediumMarch 17, 2022
• git, apple xcode, debian linux +1 more +3 more malicious repositories can execute remote code while cloning CVE-2021-21300 Public exploitFix available EPSS 88.5% 8.0 HighMarch 9, 2021
• git, canonical ubuntu linux, debian linux +1 more +3 more Malicious URLs can still cause Git to send a stored credential to the wrong server CVE-2020-11008 Fix available 4.0 MediumApril 20, 2020
• git, canonical ubuntu linux, debian linux +2 more +4 more malicious URLs may cause Git to present stored credentials to the wrong server CVE-2020-5260 Public exploitFix available EPSS 14.9% 9.3 CriticalApril 14, 2020
• git An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2,... CVE-2019-1387 Fix available 8.8 HighDecember 10, 2019
• git-for-windows git, opensuse leap +1 more CVE-2019-1353 does not affect BellSoft software CVE-2019-1353 Fix available 9.8 CriticalDecember 10, 2019
• git-for-windows git, opensuse leap +1 more CVE-2019-1348 does not affect BellSoft software CVE-2019-1348 Fix available 3.3 LowDecember 10, 2019