Git-scm Git vulnerabilities

• git, apple xcode, debian linux +2 more Git allows arbitrary code execution through broken config quoting CVE-2025-48384 In KEVPublic exploitFix available 8.1 HighJuly 8, 2025
• git, debian linux, fedoraproject fedora +2 more Git's protections for cloning untrusted repositories can be bypassed CVE-2024-32465 Fix available 7.4 HighMay 14, 2024
• git, debian linux, fedoraproject fedora +2 more Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory CVE-2024-32021 Fix available 3.9 LowMay 14, 2024
• git, fedoraproject fedora +1 more Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will CVE-2024-32020 Fix available 3.9 LowMay 14, 2024
• git, debian linux, fedoraproject fedora +2 more Git vulnerable to Remote Code Execution while cloning special-crafted local repositories CVE-2024-32004 Public exploitFix available 8.2 HighMay 14, 2024
• git, fedoraproject fedora +1 more Arbitrary configuration injection via `git submodule deinit` CVE-2023-29007 Public exploitFix available 7.0 HighApril 25, 2023
• git, fedoraproject fedora +1 more "git apply --reject" partially-controlled arbitrary file write CVE-2023-25652 Fix available EPSS 51.9% 7.5 HighApril 25, 2023
• git Git's `git apply` overwriting paths outside the working tree CVE-2023-23946 Public exploitFix available 6.2 MediumFebruary 14, 2023
• git Git vulnerable to local clone-based data exfiltration with non-local transports CVE-2023-22490 Public exploitFix available 5.5 MediumFebruary 14, 2023
• git-for-windows git Git clone remote code execution vulnerability in git-for-windows CVE-2022-41953 Fix available 8.6 HighJanuary 17, 2023
• git Integer overflow in `git archive`, `git log --format` leading to RCE in git CVE-2022-41903 Public exploitFix available EPSS 44.3% 9.8 CriticalJanuary 17, 2023
• git gitattributes parsing integer overflow in git CVE-2022-23521 Fix available EPSS 56.3% 9.8 CriticalJanuary 17, 2023
• git, apple xcode, debian linux +1 more +3 more Git vulnerable to Remote Code Execution via Heap overflow in `git shell` CVE-2022-39260 Fix available 8.5 HighOctober 18, 2022
• git, apple xcode, debian linux +1 more +3 more Git subject to exposure of sensitive information via local clone of symbolic links CVE-2022-39253 Public exploitFix available 5.5 MediumOctober 18, 2022
• git, apple xcode, debian linux +1 more +3 more Bypass of safe.directory protections in Git CVE-2022-29187 Fix available 7.8 HighJuly 12, 2022
• git-for-windows git, apple xcode, debian linux +1 more +3 more Uncontrolled search for the Git directory in Git for Windows CVE-2022-24765 Fix available 6.0 MediumApril 12, 2022
• git-scm git The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted... CVE-2022-24975 Fix availableDisputed 7.5 HighFebruary 11, 2022
• git-scm git, debian linux +1 more git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline... CVE-2021-40330 Fix available 7.5 HighAugust 31, 2021
• git, apple xcode, debian linux +1 more +3 more malicious repositories can execute remote code while cloning CVE-2021-21300 Public exploitFix available EPSS 88.5% 8.0 HighMarch 9, 2021
• git, canonical ubuntu linux, debian linux +1 more +3 more Malicious URLs can still cause Git to send a stored credential to the wrong server CVE-2020-11008 Fix available 4.0 MediumApril 20, 2020
• git, canonical ubuntu linux, debian linux +2 more +4 more malicious URLs may cause Git to present stored credentials to the wrong server CVE-2020-5260 Public exploitFix available EPSS 14.9% 9.3 CriticalApril 14, 2020
• git-scm git, debian linux, fedoraproject fedora +1 more +3 more Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before... CVE-2019-19604 Fix available 7.8 HighDecember 10, 2019
• git An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2,... CVE-2019-1387 Fix available 8.8 HighDecember 10, 2019
• git-for-windows git, opensuse leap +1 more CVE-2019-1353 does not affect BellSoft software CVE-2019-1353 Fix available 9.8 CriticalDecember 10, 2019
• git-for-windows git, opensuse leap +1 more CVE-2019-1348 does not affect BellSoft software CVE-2019-1348 Fix available 3.3 LowDecember 10, 2019
• git-scm git, canonical ubuntu linux +1 more Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '... CVE-2018-19486 Fix available 9.8 CriticalNovember 23, 2018
• git-scm git, canonical ubuntu linux, debian linux +8 more +10 more Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x... CVE-2018-17456 Public exploitFix available EPSS 97.4% 9.8 CriticalOctober 5, 2018
• git-scm git, canonical ubuntu linux +1 more In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17... CVE-2018-11233 Fix available 7.5 HighMay 30, 2018
• git-scm git, canonical ubuntu linux, debian linux +5 more +7 more In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17... CVE-2018-11235 Public exploitFix available EPSS 48.1% 7.8 HighMay 29, 2018
• git-scm git GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can... CVE-2018-1000021 5.0 MediumFebruary 9, 2018
• git-scm git, canonical ubuntu linux +1 more Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a... CVE-2017-15298 Fix available 5.5 MediumOctober 14, 2017
• git-scm git, debian linux +1 more Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x... CVE-2017-14867 Fix available EPSS 36.0% 8.8 HighSeptember 26, 2017
• git-scm git A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an... CVE-2017-1000117 Public exploitFix available EPSS 77.8% 8.8 HighAugust 10, 2017
• git-scm git contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1... CVE-2014-9938 Fix available 8.8 HighMarch 19, 2017
• git-scm git, opensuse leap, opensuse +4 more +6 more revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers... CVE-2016-2315 Fix available EPSS 17.3% 9.8 CriticalMarch 16, 2016
• git-scm git, opensuse leap, opensuse +4 more +6 more Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1)... CVE-2016-2324 Fix available EPSS 18.1% 9.8 CriticalMarch 15, 2016
• apple xcode, eclipse egit, jgit +3 more +5 more JGit Improper Input Validation vulnerability CVE-2014-9390 Public exploitFix available EPSS 75.6% 9.8 CriticalDecember 19, 2014
• git-scm git The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a... CVE-2013-0308 Fix available 4.3 MediumMarch 8, 2013
• git Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to... CVE-2010-3906 Public exploitFix available 4.3 MediumDecember 17, 2010
• git-scm git Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1... CVE-2010-2542 Fix available 7.5 HighAugust 11, 2010
• git The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary... CVE-2008-5516 Fix available 7.5 HighJanuary 19, 2009