Git Git vulnerabilities

• git Git allows a buffer overflow in 'wincred' credential helper CVE-2025-48386 Fix available 6.3 MediumJuly 8, 2025
• git Git alllows arbitrary file writes via bundle-uri parameter injection CVE-2025-48385 Fix available 8.6 HighJuly 8, 2025
• git, apple xcode, debian linux +2 more Git allows arbitrary code execution through broken config quoting CVE-2025-48384 In KEVPublic exploitFix available 8.1 HighJuly 8, 2025
• git The sideband payload is passed unfiltered to the terminal in git CVE-2024-52005 Public exploitFix available 7.5 HighJanuary 15, 2025
• git, debian linux +1 more Newline confusion in credential helpers can lead to credential exfiltration in git CVE-2024-52006 Fix available 2.1 LowJanuary 14, 2025
• git, debian linux +1 more Git does not sanitize URLs when asking for credentials interactively CVE-2024-50349 Fix available 2.1 LowJanuary 14, 2025
• git git-shallow-clone git-shallow-clone Argument Injection vulnerability CVE-2024-21531 5.3 MediumOctober 1, 2024
• git, debian linux, fedoraproject fedora +2 more Git's protections for cloning untrusted repositories can be bypassed CVE-2024-32465 Fix available 7.4 HighMay 14, 2024
• git, debian linux, fedoraproject fedora +2 more Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory CVE-2024-32021 Fix available 3.9 LowMay 14, 2024
• git, fedoraproject fedora +1 more Cloning local Git repository by untrusted user allows the untrusted user to modify objects in the cloned repository at will CVE-2024-32020 Fix available 3.9 LowMay 14, 2024
• git, debian linux, fedoraproject fedora +2 more Git vulnerable to Remote Code Execution while cloning special-crafted local repositories CVE-2024-32004 Public exploitFix available 8.2 HighMay 14, 2024
• git Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution CVE-2024-32002 Public exploitFix available EPSS 29.2% 9.1 CriticalMay 14, 2024
• git, fedoraproject fedora +1 more Arbitrary configuration injection via `git submodule deinit` CVE-2023-29007 Public exploitFix available 7.0 HighApril 25, 2023
• git, fedoraproject fedora +1 more "git apply --reject" partially-controlled arbitrary file write CVE-2023-25652 Fix available EPSS 51.9% 7.5 HighApril 25, 2023
• git Git's `git apply` overwriting paths outside the working tree CVE-2023-23946 Public exploitFix available 6.2 MediumFebruary 14, 2023
• git Git vulnerable to local clone-based data exfiltration with non-local transports CVE-2023-22490 Public exploitFix available 5.5 MediumFebruary 14, 2023
• git Integer overflow in `git archive`, `git log --format` leading to RCE in git CVE-2022-41903 Public exploitFix available EPSS 44.3% 9.8 CriticalJanuary 17, 2023
• git gitattributes parsing integer overflow in git CVE-2022-23521 Fix available EPSS 56.3% 9.8 CriticalJanuary 17, 2023
• git, apple xcode, debian linux +1 more +3 more Git vulnerable to Remote Code Execution via Heap overflow in `git shell` CVE-2022-39260 Fix available 8.5 HighOctober 18, 2022
• git, apple xcode, debian linux +1 more +3 more Git subject to exposure of sensitive information via local clone of symbolic links CVE-2022-39253 Public exploitFix available 5.5 MediumOctober 18, 2022
• git, apple xcode, debian linux +1 more +3 more Bypass of safe.directory protections in Git CVE-2022-29187 Fix available 7.8 HighJuly 12, 2022
• git, debian linux, fedoraproject extra packages for enterprise linux +1 more +3 more Command Injection CVE-2022-25648 Fix available 8.1 HighApril 19, 2022
• git, apple xcode, debian linux +1 more +3 more malicious repositories can execute remote code while cloning CVE-2021-21300 Public exploitFix available EPSS 88.5% 8.0 HighMarch 9, 2021
• git, canonical ubuntu linux, debian linux +1 more +3 more Malicious URLs can still cause Git to send a stored credential to the wrong server CVE-2020-11008 Fix available 4.0 MediumApril 20, 2020
• git, canonical ubuntu linux, debian linux +2 more +4 more malicious URLs may cause Git to present stored credentials to the wrong server CVE-2020-5260 Public exploitFix available EPSS 14.9% 9.3 CriticalApril 14, 2020
• git An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2,... CVE-2019-1387 Fix available 8.8 HighDecember 10, 2019
• git git-shell, canonical ubuntu linux, debian linux +2 more +4 more git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x... CVE-2017-8386 Public exploitFix available EPSS 12.4% 8.8 HighMay 10, 2017
• git Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to... CVE-2010-3906 Public exploitFix available 4.3 MediumDecember 17, 2010
• git git-daemon in git 1.4.4.5 through 1.6.3 allows remote attackers to cause a denial of service ... CVE-2009-2108 Public exploitFix available 5.0 MediumJune 18, 2009
• git gitweb/gitweb.perl in gitweb in Git 1.6.x before 1.6.0.6, 1.5.6.x before 1.5.6.6, 1.5.5.x before... CVE-2008-5916 Fix available 4.6 MediumJanuary 19, 2009
• git The web interface in git (gitweb) 1.5.x before 1.5.5 allows remote attackers to execute arbitrary... CVE-2008-5516 Fix available 7.5 HighJanuary 19, 2009
• git The web interface in git (gitweb) 1.5.x before 1.5.6 allows remote attackers to execute arbitrary... CVE-2008-5517 Public exploitFix available EPSS 11.9% 7.5 HighJanuary 13, 2009
• git Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before... CVE-2008-3546 Fix available 7.5 HighAugust 7, 2008
• git Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute... CVE-2006-0477 7.5 HighJanuary 31, 2006