CVSS: 8.1EPSS: 0%CPEs: 8EXPL: 0CVE-2025-48384 – Git allows arbitrary code execution through broken config quoting
https://notcve.org/view.php?id=CVE-2025-48384
08 Jul 2025 — Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodu... • https://github.com/git/git/security/advisories/GHSA-vwqx-4fm8-6qc9 • CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-436: Interpretation Conflict •
CVSS: 8.8EPSS: 0%CPEs: 8EXPL: 0CVE-2025-48385 – Git alllows arbitrary file writes via bundle-uri parameter injection
https://notcve.org/view.php?id=CVE-2025-48385
08 Jul 2025 — Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the... • https://github.com/git/git/security/advisories/GHSA-m98c-vgpc-9655 • CWE-73: External Control of File Name or Path CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 6.3EPSS: 0%CPEs: 8EXPL: 0CVE-2025-48386 – Git allows a buffer overflow in 'wincred' credential helper
https://notcve.org/view.php?id=CVE-2025-48386
08 Jul 2025 — Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v... • https://github.com/git/git/security/advisories/GHSA-4v56-3xvj-xvfr • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-6274 – S3 and Glacier remotes creds embedded in the git repo were not encrypted
https://notcve.org/view.php?id=CVE-2014-6274
26 Jun 2025 — git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credentials were stored in the git repository in (effectively) plaintext, not encrypted as they were supposed to be. This issue affects git-annex: from 3.20121126 before 5.20140919. git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes was set, and the remote used encryption=pubkey or encryption=hybrid, the embedded AWS credential... • https://git-annex.branchable.com/upgrades/insecure_embedded_creds • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2024-52005 – The sideband payload is passed unfiltered to the terminal in git
https://notcve.org/view.php?id=CVE-2024-52005
15 Jan 2025 — Git is a source code management tool. When cloning from a server (or fetching, or pushing), informational or error messages are transported from the remote Git process to the client via the so-called "sideband channel". These messages will be prefixed with "remote:" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that c... • https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329 • CWE-116: Improper Encoding or Escaping of Output CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-53263 – Git LFS permits exfiltration of credentials via crafted HTTP URLs
https://notcve.org/view.php?id=CVE-2024-53263
14 Jan 2025 — Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's G... • https://github.com/git-lfs/git-lfs/commit/0345b6f816e611d050c0df67b61f0022916a1c90 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 3.1EPSS: 0%CPEs: 9EXPL: 0CVE-2024-50349 – Git does not sanitize URLs when asking for credentials interactively
https://notcve.org/view.php?id=CVE-2024-50349
14 Jan 2025 — Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt (i.e. without using any credential helper), it prints out the host name for which the user is expected to provide a username and/or a password. At this stage, any URL-encoded parts have been decoded already, and are printed verbatim. This allows attackers to craft URLs that contain ANSI escap... • https://github.com/git/git/commit/7725b8100ffbbff2750ee4d61a0fcc1f53a086e8 • CWE-116: Improper Encoding or Escaping of Output CWE-147: Improper Neutralization of Input Terminators CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2024-52006 – Newline confusion in credential helpers can lead to credential exfiltration in git
https://notcve.org/view.php?id=CVE-2024-52006
14 Jan 2025 — Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. Git defines a line-based protocol that is used to exchange information between Git and Git credential helpers. Some ecosystems (most notably, .NET and node.js) interpret single Carriage Return characters as newlines, which renders the protections against CVE-2020-5260 incomplete for credential helpers that treat Carriage Returns in this way. T... • https://github.com/git-ecosystem/git-credential-manager/security/advisories/GHSA-86c2-4x57-wc8g • CWE-116: Improper Encoding or Escaping of Output CWE-147: Improper Neutralization of Input Terminators CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50338 – Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager
https://notcve.org/view.php?id=CVE-2024-50338
14 Jan 2025 — Git Credential Manager (GCM) is a secure Git credential helper built on .NET that runs on Windows, macOS, and Linux. The Git credential protocol is text-based over standard input/output, and consists of a series of lines of key-value pairs in the format `key=value`. Git's documentation restricts the use of the NUL (`\0`) character and newlines to form part of the keys or values. When Git reads from standard input, it considers both LF and CRLF as newline characters for the credential protocol by virtue of c... • https://git-scm.com/docs/git-credential#IOFMT • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.2EPSS: 0%CPEs: 1EXPL: 0CVE-2025-21614 – go-git clients vulnerable to DoS via maliciously crafted Git server replies
https://notcve.org/view.php?id=CVE-2025-21614
06 Jan 2025 — go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability. Go-git es una librería de imp... • https://github.com/go-git/go-git/security/advisories/GHSA-r9px-m959-cxf4 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •